1 Avoiding Hacker Attacks

2 Objectives You will be able to Avoid certain hacker attacks and crashes due to bad inputs from users.

3 Getting Started Start with the Databound ComboBox from last class: Downloads/2011_04_12_Hacker_Attacks/ Downloads/2011_04_12_Hacker_Attacks/ File Alt_Databound_Combo_Box.zip Download Extract Build and run

4 Hacker Attacks Any time we accept user input and put it into a command string, there is a danger of hacker attacks. A user can enter information that subverts the command we meant to give and makes it do something else. Example: Connection String Parameter attack Palazon/DEFCON-18-Alonso-Palazon-String.pdf Palazon/DEFCON-18-Alonso-Palazon-String.pdf Thanks to student Ryan Wheeler for this reference!

5 The Connection String String cs = "server=scorpius.eng.usf.edu; " + "User=" + tbUserName.Text + ";" + "Password=" + tbPassword.Text; At run time: server=scorpius.eng.usf.edu;User=wpusr40;Password=xxxxx Connection string is a series of pairs separated by semicolors. If a parameter appears multiple times, the last one wins. The user can type a semicolon in the password box and add his own parameter to the connection string.

The Threat If you don't prevent this kind of attack an unscrupulous user can redirect your application to any server of his choice. 6

7 A Connection String Parameter Attack Password: xxxxx;server=sql2k508.discountasp.net

8 A Connection String Parameter Attack Toby, I don't think we are on scorpius any more!

9 Customer Selected

10 Defense Against the Dark Arts To foil this attack, scan user inputs for semicolons. Reject any input including a semicolon.

11 Checking for Semicolons private void btnLogIn_Click(object sender, EventArgs e) { String cs = "server=scorpius.eng.usf.edu; " + "User=" + tbUserName.Text + ";" + "Password=" + tbPassword.Text; if ((tbUserName.Text.IndexOf(';') >= 0) || (tbPassword.Text.IndexOf(';') >= 0)) { MessageBox.Show("Invalid input"); return; } Select_Customer sc = new Select_Customer(cs); this.Hide(); sc.ShowDialog(); this.Show(); }

12 Foiled Attack Password: xxxxx;server=sql2k508.discountasp.net