• (cs) in reply to Connect to Reality
    Connect to Reality:
    Who actually uses Access, for anything?

    A lot of people for many things.

  • (cs) in reply to Connect to Reality
    Connect to Reality:
    Who actually uses Access, for anything?
    My standard advise is if you're using Access for anything more complicated than a $HOLIDAY card list then you need to move up.

    That being said, we still have far too many of those Access beasts out in the wild. It would help if we stopped installing Access as part of the standard desktop but that's too easy.

  • (cs) in reply to rudraigh

    After years of practice, I finally found a use for Access; rapidly writing queries to access MySQL via ODBC. If I was any good at writing SQL then Access would be truly useless...

  • (cs) in reply to Bruce W
    Bruce W:
    Since I worked for Arthur Andersen when Accenture was still Andersen Consulting I enjoy *anything* that pokes fun at self-absorbed AC consultants.
    Is that the same Arthur Andersen that was involved, not just with Enron, but *every* major accounting scandal of the last twenty years?
  • (cs) in reply to Addison
    Addison:
    *shakes fist*

    I use ASP (.Net though) and I can tell you that large sessions KILL EVERYTHING. Who'd have thought IE crashes when presented with a 2 meg postback? Weird, huh?

    /sarcasm

    I see your 2 megs and raise you 6. Yes, that's right, we had pages with 8 megs of postback...over dial-up.

  • Max (unregistered)

    This actually sounds like everything worked as intended. Yes, there are technical problems, but...

    We're talking about an HR system. Which means people's private data. Which most companies are wary iof having internal IT able to view, as it allows IT staff to view everyone's salaries. So it is very common to outsource HR.

    Likewise, IT's job is not actually to make technical decisions. It is to make technical recommendations, then let management decide which is more important -- the technical needs, or the business needs. In this case, the business need for HR to be outsourced is more important to management than the technical issues.

    So yes, there are issues here. The biggest one being a lack of effort to find a better vendor. But it sounds like the evaluation process worked exactly as intended.

  • Tom Woolf (unregistered) in reply to Little bobby... oh FFS you know the joke
    Little bobby... oh FFS you know the joke:
    Protector one:
    Could someone explain why typing ' OR ''=' in the password field would give him access to anything? I don't see the magic happening there. :/

    see http://xkcd.com/327/ and http://en.wikipedia.org/wiki/SQL_injection if you still dont get it

    "Thank you" from someone who does not know .ASP. I understood the concept of code injection, but like Protector one I did not know how that particular item worked.

  • MP (unregistered) in reply to Max
    Max:
    This actually sounds like everything worked as intended. Yes, there are technical problems, but...

    We're talking about an HR system. Which means people's private data. Which most companies are wary iof having internal IT able to view, as it allows IT staff to view everyone's salaries. So it is very common to outsource HR.

    Likewise, IT's job is not actually to make technical decisions. It is to make technical recommendations, then let management decide which is more important -- the technical needs, or the business needs. In this case, the business need for HR to be outsourced is more important to management than the technical issues.

    So yes, there are issues here. The biggest one being a lack of effort to find a better vendor. But it sounds like the evaluation process worked exactly as intended.

    I don't think you understand the security implications here. Instead of hiding information, all information is now publicly available.

  • SQLinjector (unregistered) in reply to Barrett Jacobsen

    [quote user="Barrett Jacobsen"][quote user="Protector one"]Could someone explain why typing ' OR ''=' in the password field would give him access to anything? I don't see the magic happening there. :/[/quote]

    sometimes I getted scared

  • threecheese (unregistered) in reply to rudraigh
    rudraigh:
    Connect to Reality:
    Who actually uses Access, for anything?

    A lot of people for many things.

    It's quite useful to have an integrated visual query and report builder in your admin system; we use it with a mysql backend (via odbc). It's damn simple to extend (dao for standard sql, ado if you need db-specific dialect).
    And, why not rs("username")? Saves you from RSD....

  • Ben4jammin (unregistered)
    Why listen to your IT department when management know exactly what is best? I wonder why some companies bother having an IT department at all, surely it's just an unnecesary overhead?

    You don't think management is going to take the fall do you? Like in this case when everyone in the company becomes a victim of identify theft due to HR type info being served via a web page. We dumped our last HR system after their implementation team told us we needed to put the anonymous Internet user account in local admin on the web server. What could possibly go wrong?

  • Anonymoose (unregistered) in reply to Barrett Jacobsen

    SQL Injection FTW!

  • Anonymous (unregistered) in reply to rudraigh
    rudraigh:
    Connect to Reality:
    Who actually uses Access, for anything?
    A lot of people for many things.
    I second this. I'm currently using an old Access CD as a coaster and the other day we had an exhilarating game of office frisbee with Access 2007.
  • Ian (unregistered) in reply to basseq

    Yeah, not so much. All the projects I've worked on were fairly heavy SQL and Oracle installs, which is unsurprising considering that they're business partners.

    ~I

  • Ozz (unregistered) in reply to Tom Woolf
    Tom Woolf:
    Little bobby... oh FFS you know the joke:
    see http://xkcd.com/327/ and http://en.wikipedia.org/wiki/SQL_injection if you still dont get it
    "Thank you" from someone who does not know .ASP. I understood the concept of code injection, but like Protector one I did not know how that particular item worked.
    This was not .ASP specific.
  • (cs) in reply to Ozz
    Ozz:
    Tom Woolf:
    "Thank you" from someone who does not know .ASP. I understood the concept of code injection, but like Protector one I did not know how that particular item worked.
    This was not .ASP specific.
    There is no .ASP.
  • Dave (unregistered) in reply to Barrett Jacobsen

    But surely ' OR ''=' would be hashed and compared to the hashed password stored in their database ...

  • Ozz (unregistered) in reply to Dave
    Dave:
    But surely ' OR ''=' would be hashed and compared to the hashed password stored in their database ...
    Why? (Think about it...)
  • Anon (unregistered) in reply to Been There
    Been There:
    Oh, but in their defense, the colors were quite vivid. And our marketing people were infatuated with their marketing people.

    I've always thought that people who bullshit for a living (i.e. marketing people) would be immune to other people's bullshit, but no, this has not been my experience. It seems to me that the people who are most vulnerable to marketing-speak are other marketing people.

    Which leads me to the deeply worrying and shocking conclusion that marketing people actually believe their own bullshit! And naturally assume that other marketing "professionals" are telling the complete, total, 100% truth.

    This conclusion makes me weep for humanity.

  • Wizard Stan (unregistered)

    As a current Accenture employee, I can safely say I've never seen anyone use Access. I've had people ask about using Access, and merrily told them "don't", but no one actually using it. I'm sure they're out there somewhere. On the other hand, I do routinely work with Sybase.

  • John (unregistered)

    So because some bloke in IT doesn't like Microsoft, he tried to obstruct HR from setting up a web portal the way they wanted to do it. He mislead management about the quality of Access (it isn't that bad) and the nature of the application (an internal HR site isn't really "production").

    Did he consider the situation from HR's POV? Of course not. If he did, hed have realised that a system that's easy to set up will save the most time overall. The next Amazon or Google was not required here.

    Submitter is the real-life incarnation of Mordor the denier of information services. When he didn't get his way, he broke his NDA on a web blog whose sole purpose is to indulge whiny geeks. What an obstructionist, passive-agressive l()()zer!!!1

  • (cs) in reply to Barrett Jacobsen
    Barrett Jacobsen:
    Protector one:
    Could someone explain why typing ' OR ''=' in the password field would give him access to anything?
    Because the code that called the SQL they were using was probably along the lines of ...WHERE...AND [Password] = '" + string_user_entered + "'

    Which when inputed with ' OR ''=' results in the following SQL ...WHERE...AND [Password] = '' OR ''=''

    Notice the last part the OR ''='' - that's always going to be true :P

    If so many sites fall prey to this kind of code injection, why doesn't the software treat outside stings as potentially poisonous rather than trusting them as much as the programmer-supplied strings? Shouldn't it treat outside strings literally, and limit expansion and interpretation to trusted stings?

  • jay (unregistered)

    When I try this form of SQL injection, I always give my password as

    ' OR 'X'='X

    This accomplishes the same thing as the example given, but I think it's much clearer to the reader. I'm a firm believer in clear and maintainable code!

  • jay (unregistered)

    On the mildly serious side: Access is fine for an application that is going to run on the user's desktop, and only be accessed (no pun intended) by one user at a time. Indeed, it might actually be a good choice for this: It's easy to install and requires no configuration and little maintenance. I would definately not want to ask your ordinary user with no IT experience to install Oracle on his desktop and then keep it properly configured and tuned. But using Access for a web application is crazy.

    It always grates on me when people say, "Tool X is the latest and greatest thing! We should use Tool X for every future project!" Just because a tool is good for project A doesn't mean it's good for project B.

    Pick the right tool for the job. If you want to travel from New York to London, a commercial airliner is an excellent choice. But if you want to travel from your home to a town 10 miles away, a commercial flight would be foolish. Not only would it be far more expensive than driving yourself, but even if both towns had airports, sure, the flying time is likely almost zero, but the time spent going through security and picking up your luggage would likely be longer than what it would take to drive.

  • Dr. Evil (unregistered) in reply to Code Dependent
    Code Dependent:
    Ozz:
    Tom Woolf:
    "Thank you" from someone who does not know .ASP. I understood the concept of code injection, but like Protector one I did not know how that particular item worked.
    This was not .ASP specific.
    There is no .ASP.

    "there is no spoon."

  • Dr. Evil (unregistered) in reply to John
    John:
    So because some bloke in IT doesn't like Microsoft, he tried to obstruct HR from setting up a web portal the way they wanted to do it. He mislead management about the quality of Access (it isn't that bad) and the nature of the application (an internal HR site isn't really "production").

    Did he consider the situation from HR's POV? Of course not. If he did, hed have realised that a system that's easy to set up will save the most time overall. The next Amazon or Google was not required here.

    Submitter is the real-life incarnation of Mordor the denier of information services. When he didn't get his way, he broke his NDA on a web blog whose sole purpose is to indulge whiny geeks. What an obstructionist, passive-agressive l()()zer!!!1

    Would you be John the TopCod3r?

  • AdT (unregistered) in reply to Max
    Max:
    We're talking about an HR system. Which means people's private data. Which most companies are wary iof having internal IT able to view, as it allows IT staff to view everyone's salaries.

    So you agree that security is a numer one priority?

    Max:
    Likewise, IT's job is not actually to make technical decisions. It is to make technical recommendations, then let management decide which is more important -- the technical needs, or the business needs.

    So you think that technical needs such as security and performance aren't business needs as well? And that it is invalid to criticize management when they make very obviously flawed decisions? Your argument sounds like "Tech guys just don't get it. There are more important things than that. Management knows best, trust them."

    It's not like we were talking about the performance being a bit low but fairly usable, or the password hash algorithm being cryptanalyzed for 13 out of 40 rounds. We are talking about seriously flawed through lack of competence. To make good decisions, you need good advisors, but you also need to know a bit about the issues involved. Management is generally lacking in the IT competence department to say the least. IT problems are abstract and invisible, and managers often tend to be more visually-oriented. WARNING, CAR ANALOGY AHEAD. They would never buy a car that's losing oil and fuel almost as quickly as you can refill it, that has a chassis covered in rust and defective brakes. However, the IT equivalent of doing that is perfectly fine with them.

    Max:
    In this case, the business need for HR to be outsourced is more important to management than the technical issues.

    IOW: They asked IT for their opinion, and IT truthfully came up with pretty much the most scathing criticism you can think of. They purchased it anyway. So nothing that IT could have said would have prevented management from buying. This means that asking IT was completely redundant and a waste of resources.

  • aloria (unregistered) in reply to Ben Jammin
    Ben Jammin:
    For some extra resources on SQL Injection:

    http://xkcd.com/327/

    (oldie but goodie)

    Wrong. xkcd is never "good."

  • Addison (unregistered) in reply to mr_smith
    mr_smith:
    Addison:
    *shakes fist*

    I use ASP (.Net though) and I can tell you that large sessions KILL EVERYTHING. Who'd have thought IE crashes when presented with a 2 meg postback? Weird, huh?

    /sarcasm

    Like the other guy said, yer mixing up session and viewstate. viewstate is a type of session - http://www.martinfowler.com/eaaCatalog/clientSessionState.html

    The session they are talking about here means the server side session. Don't stick 2mb worth of anything in the viewstate! That's a WTF all in itself.

    You're right, sorry. I have mixed them up in the past as well. . . you'd think it'd stick eventually.

  • DisInformation (unregistered)

    Who actually uses access for anything serious? Me. Large organisation and no chance of getting anything better through IT.

    And say what you like about Access. But I've quietly used it to take a number of mission critical Excel "databases" behind the woodshed and shoot them. To the overwhelming joy of the people forced to use them.

    (Excel databases in some cases having in excess of 70 columns, more than a dozen of which were populated by VLOOKUPS, and requiring regular manual updates by a dozen people.)

  • Addison (unregistered) in reply to aloria
    aloria:
    Ben Jammin:
    For some extra resources on SQL Injection:

    http://xkcd.com/327/

    (oldie but goodie)

    Wrong. xkcd is never "good."

    Yeah. It's always GREAT.

  • JVee (unregistered)

    But I didn't see this line:

        session(“PASSWORD”) = rs.Fields(“password”).value

    How do they re-authenticate the user on a postback?

  • (cs) in reply to Anon
    Anon:
    It seems to me that the people who are most vulnerable to marketing-speak are other marketing people.
    [image]
  • Illiterate (unregistered)
    ...This is just one example.” v“For optimization,”

    Because I'm slow, this is buggy and difficult to read.

  • Shinobu (unregistered)

    Some thoughts on this... You don't do reviews primarily to convince people, but to make sure the paperwork exists to exonerate you in case of catastrophic failure. The concept of trying to improve your company because you depend on it for your livelihood is nice, but it doesn't apply to most programmers who can easily find a job elsewhere and you're not going to succeed anyway. Improving products for your users is lovely, but if your overlords wanted that they would have told you. If you think this robs your life of meaning, get a hobby or switch jobs. And consumers pretty much get what they deserve anyway. They choose what software to buy. They support the governments who decide what the penalties for leaking personal information and other kinds of software failure are. And if you still feel uneasy about it all, if you're smart enough to be a programmer, you're probably smart enough to be scientist. I've known two people who switched careers like that (one from architect - that is brick and mortar, not software architect - and another from programming drone) and I think they're happier now.

  • (cs) in reply to John

    HR should be as concerned about security of their data as IS. Being able to get into the admin console via a simple password hack is not something I'd expect to find acceptable for a database that stores employee records. The use of Access wouldn't be so bad if it wasn't set up for a web app. Multiple users accessing that DB could cause problems as Access is not really set up for that sort of concurrent use. The Data is "Production" as its data that is used to run the company, how would you feel if the data was wiped out due to something crashing. Getting paid ? well maybe .....

  • Zug (unregistered) in reply to Barrett Jacobsen

    The code they used would actually read:

    AND password_field = ' user_string ';

    So replace user_string with 

    ' OR '' = '

    And you get

     AND password_field = ' ' OR ' ' = ' ';

    In English, if the user's password from the database equals blank string OR if blank string equals blank string.

    Blank string always equals blank string. Therefore, access granted.

  • Bob (unregistered) 
    #include <stdio.h>

int main ()
{
puts("http://xkcd.com/327");
return 0;
}
  • Gnubeutel (unregistered)

    I don't know whatever Microsoft abomination that code is, but...

    do
  //read row from user table
loop

    Are they expecting to match more than one user?

  • MJB (unregistered) in reply to Gnubeutel 
    do
  //read row from user table
loop
    Are they expecting to match more than one user?

    Of course not, but the developer probably copied the structure directly from a "Learn ASP in 24 H0urs!1!!!1 book -- From the chapter on how to retrieve records from a database.

  • dave (unregistered) in reply to Gnubeutel
    Gnubeutel:
    I don't know whatever Microsoft abomination that code is, but... 
    do
  //read row from user table
loop
    Are they expecting to match more than one user?

    well, the developer is using an access database with very blatant SQL injection all being powered by ASP. the guess is that they copy/pasted the code from someone else or an old project where there was a DB call and they didnt feel like re-writing it. I can understand this, i suppose, IF they put a LIMIT 1 on the SQL call.

    also this is not the code from the actual project, if it was "rs" wouldnt be "Rs" by the end of the code block.

  • Franz Kafka (unregistered) in reply to vt_mruhlin
    vt_mruhlin:
    Well, if Accenture did it!

    Did you guys see that story on Digg a while back about how the London Stock Exchange was "ditching Windows", because some (Windows based) software Accenture wrote crashed, so they were replacing it with a (Unix based) alternative?

    Yeah, I'm sure Windows was the deciding factor there, not some idiot at Accenture's shitty code.

    It's worse than that: Microsoft drove the LSE project top to bottom to demonstrate that they could play with the big boys. So Accenture may have fucked up, but you can lay the blame for the LSE mess at microsoft's feet - they chose the platform and the people to build on it, and they got involved at all levels of the project.

  • Franz Kafka (unregistered) in reply to Niels
    Niels:
    So, if HR explicitly chooses to use a system without security. Does that make it legal to 'improve' the data in such a system ... like everyone's salary (except the HR people of cource)?

    well no, that's still illegal, but it does make the data completely suspect if anybody can log on as anybody else and do that.

  • Kelsey Grammar (unregistered) in reply to Florian Junker

    Really? In high school, did you really know any better? Or did you hit the Access scalability wall in your school projects?

    If so, then salut.

  • Loren Pechtel (unregistered) in reply to Protector one
    Protector one:
    Could someone explain why typing ' OR ''=' in the password field would give him access to anything? I don't see the magic happening there. :/

    I'm going to guess it's some form of SQL injection.

  • Franz Kafka (unregistered) in reply to Kelsey Grammar
    Kelsey Grammar:
    Really? In high school, did you really know any better? Or did you hit the Access scalability wall in your school projects?

    If so, then salut.

    Doesn't access scale to 10 connections at most?

  • (cs)

    It was probably easier for Accenture to pirate Access licenses.

    http://attrition.org/errata/sec-co/foundstone-02.html

    Yes I am still bitter all these years later.

  • anonymous developer (unregistered) in reply to Franz Kafka
    Franz Kafka:
    Kelsey Grammar:
    Really? In high school, did you really know any better? Or did you hit the Access scalability wall in your school projects?

    If so, then salut.

    Doesn't access scale to 10 connections at most?

    well Access is just horribly inefficient with queries, the other saleability problem is that once you do queries on records that have thousands of rows it takes bloody long to complete, even if you are just doing a simple look up on a Primary Key.

  • arkangel (unregistered) in reply to dave
    dave:
    also this is not the code from the actual project, if it was "rs" wouldnt be "Rs" by the end of the code block.

    ASP isn't case sensitive so you could write it both ways in the same block of code and they'd both refer to the same variable.

  • dude (unregistered) in reply to Barrett Jacobsen

    To top it all off, if this particular SQL injection works as described, it also means that the passwords are stored in plain-text.

Leave a comment on “Slow, Difficult to Code, and Buggy”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article