I'm in a weird situation, I don't know how to feel. Not sure if I can tell the whole story in short, but basically my friend WM (webmaster) works for a company, he hired me (for some basic front end stuff) and my acquaintance Dev (PHP developer) for a project. The problem is that WM and Dev are HIGHLY incompetent for some matters (like security) and I've known this for a while.

@reed You've just described every web project ever

Sounds like they are building something like this:

medium.com/@sresearcher039/…

Some time ago I happened to see Dev's code for another project where I was not involved, and... I was shocked. But I didn't tell them anything, it was not my job, I wasn't expected to read or touch his code, didn't know him much (or at all). So, I am expecting his code to be a disaster (just checked: it's already a disaster), but now I'm involved in the project, and I can't keep quiet

I can't keep quiet because, although I'm not a security professional, I know "something" and WM knows I know something. Most importantly, if anything bad happens (attack), I cannot be like "Oh, I knew it, there's a vuln here and here". They would tell me: ok, so why didn't you tell us before? Also, I believe Dev is so incompetent that if anything bad happens he (we) could be sued, because by looking at his code you can think there's some "gross negligence"

@reed That's "relatively" simple. The starting point is always the same: make sure the business understands what is going on and what the risk is. AKA talk to whoever is in charge of the project and explain your concerns.

So yes, don't keep quiet

However, keep in mind that the business itself is unlikely to care

So don't be surprised if the final answer is, "Meh, the software works and there is no budget for redoing it"

That's when things get tricky

You don't really have to worry about "gross negligence" though. It doesn't matter what the source code looks like, or how little time is spent on security. If an attacker takes advantage of a vulnerability and damage is done, then customers will be able to sue regardless of "gross negligence" (although that rarely happens, especially for small businesses)

Although claims of "gross negligence" or "This was brought to their attention and they ignored it" may make the damages higher if it came up in a lawsuit. Although I really wouldn't worry about it. Like anything else, you are involved in this project and know that there is an issue that puts the project at risk. Therefore you should bring it up with whoever is in charge.

My idea is to talk to Dev first, and make them aware I am aware of lots of mistakes. The only problem is finding the right time to tell them, and how to tell them. Because it's not something like "fix this thing you have forgotten here". It's more like "You have no understanding of security whatsoever, you need to learn and rewrite a lot of stuff".

Whether or not the issue gets resolved is a completely different question

@reed Personally I could go either way on that. If the dev doesn't care then he certainly isn't going to start re-writing everything. If he does care he probably still won't do anything without permission from whoever is running the thing because the business is paying for this, so a rewrite can't really happen without permission anyway.

I think the interpretation of "gross negligence" varies from country to country. Not sure what it is here. All I know is that I "feel" there's some gross negligence going on here, and also if I keep quiet

So at the end of the day it is really the business that needs to understand what is going on and decide, "We really need to fix this". If that is what they decide to do they may try to work with the current dev to rewrite things, or they may decide to just hire someone else and start over. In reality though neither of those things will happen - they will shrug their shoulders and go on without change

So while you are reporting this to them, you should decide what, if anything, you will do after they decide that they don't care.

And yes, the dev may be very angry with you for talking to the business about this, but realistically it is the business that needs to know about this because it is their risk.

Learning and rewriting everything would cost too much, of course redoing things right is not included in any budget or estimates. So I'm not sure what is going to happen. Probably nothing, as you said. I might provide some free friendly advice, but I'm not going to "save the project" by working for free.

The first thing I need to do is think of a friendly way to say "your code is a disaster"

Again, I personally don't think you should bother talking to the dev. It's not really his problem. It's the business' problem. If the business doesn't care then he won't care.

And yes, you'll bring this up with the business and then they will dismiss it. That is exactly what will happen.

And no, you should make no attempt to fix this yourself, even if you could (unless the business asks you to of course and pays you for your work).

WM is who's in charge. BTW, I had told WM about my worries before the project even started to be estimated (told them I happened to see Dev's code, there were too many issues, etc.). But of course WM still hired me and Dev because we are "friends" (I think WM didn't even contact any other professionals for other estimates)

Just like many businesses don't understand the importance of good security, they also don't understand the importance of good application organization (aka "Operational Excellence"). Their only concern is two things: Can you make an application do what I ask, and how much will it cost? The long term costs are just not a consideration (until they become a problem).

Although this isn't just a "tech" problem. This is literally all of human history. Your responsibility is to make sure the business is properly informed so they at least aren't surprised if things go badly in the long run.

Maybe you are right, maybe I should talk to WM first anyway. And then, maybe, also to Dev. I'll let you know what I decide to do. Meanwhile, I might show you a nice piece of vulnerable code, but you will need to brace yourself, I'm warning you. Maybe later

Trust me, I've seen worse (or at least, equally bad)

I hired a PHP developer once who had over a decade of experience but still didn't know a single thing about application security

When I read resumes and they have sample applications listed, the first thing I do is drop in XSS payloads in any inputs. Works everytime.

He must be the same developer then :D Just something interesting I noticed: the password to connect the app to the database looked strangely familiar. It turns out it's the same user and pw of the cPanel. Ok, it might not really be a serious vulnerability here, after all if you can read or access the PHP config files it's probably already game over, but... it just makes you wonder why. Why did he create a DB user with the cPanel password? It makes no sense. That's all for now, I need to go

now that I think of if, maybe that connection doesn't even work (I haven't checked), and he just used the cPanel passwords thinking they could be used for a DB. I don't know. In any case, it's just one of the countless worrying signs

I was pressured into hiring that dev with a decade of experience. One of the first things he wrote was an API endpoint for an admin portal. It didn't check the login status, didn't limit the user to their own records, and then embedded the user input directly into the SQL query. It also had terribly inconsistent naming and white space. Complete disaster

Although to be fair he couldn't limit results to the user's account because he didn't require a user to be logged in :) It just irritated me because I had explained a million times that it was multi-tenated system. In retrospect I don't think he understood what I meant, although he never asked for clarification.

The actual code he wrote was very buggy too, which was obvious to the business team, so when I brought the security concerns up with management the decision was quickly made to let him go. There was no way he was going to get the training he needed to be productive in a reasonable amount of time

Although the whole thing was really my fault for not doing better vetting (to be fair though I was pretty new at that and had a lot of pressure from all sides to "hurry up and hire someone")

reading this @reed story, it makes me feel like I know the dev...

I just reviewed a project someone did for a client, PHP/Laravel, and the create users module can be accessed without being logged in. Anyone can access it, and create an admin account...

the change user*? the same. anyone can connect, and change an admin to a common user, and vice versa.

delete user? likewise... why bother creating users with nothing matters? anyone can access anything, and I believe the user class is just a string on the header bellow the username...

These things describe most websites, unfortunately.

I never expected to go to www.example.com/admin and be greeted by the admin dashboard...

Does yours protect the GPS data for children being tracked by smart watches for a wide variety of brands, and as a result changing a simple URL parameter can give you access to the real time, live locations of tens of thousands of children across literally the entire world?

Cause if not, you got nothing on these guys: pentestpartners.com/security-blog/gps-watch-issues-again

Discussions like this make me glad that I'm not writing web applications anymore...

@FireQuacker What do you do these days?

I'm the computer guy for an electrician company

Computer guy == sysadmin, IT help desk, CAD draftsman, etc

We do low voltage electrical like CCTV, fire alarm, card access, paging

Even with a double equals sign I can't think of any languages where a string and an array would evaluate to "equal" :p

The guys I work for know nothing about programming, I guess :)

I always put CAD at the end of the list for comic effect, but it's totally true

But in their defense, the company is too small to keep me very busy, so extra things like that don't bother me

That's true for a lot of companies. Even as a "Lead Engineer" with programming as my sole job, I still got roped in to some basic IT support on occassion

I will step in as the main sysadmin for a MAJOR bank in October, doing the knowledge transfer right now... it's going to be, well, interesting...

Going straight to being the main sysadmin? I hope your predecessor kept things well documented.

ThoriumBR in 6 months: "Their 'Transfer Money' API call requires no authorization!!!! You just need the account ids!!! THIS IS CRAZY!!!!!!!!!!!"

I will manage the virtualization environment, and I will have a team with me

but I will be the head on the charts

we have until Oct to sort out all documentation

so we will have remote meetings every other day, with the current team, and my team, very long online meetings...

ok, I'll show you this funny piece of code then. When you log in, the password is "sanitized" before being put into an SQL string (of course there are no parametrized queries, just plain old SQL strings)

what?

wait, I was actually checking the code

sanitizing passwords?

I don't know if it's temporary code, I actually saw it applied to passwords. I need to check

I imagine a password form requesting at least 8 chars, and symbols, digits, and a regex converting everything to uppercase and stripping anything not on A-Z...

I once saw a system that validated only the username, not the password. so you could login with any password, or without typing a password at all

Anyway, in case you want to know, in the old code for the other project I had seen, he was not storing passwords in plain text... but he was using SHA256. That's it. No salts, no iterations, plain SHA256. You see, it's like he cares about security, but... lol

we used to make fun of those who didn't knew that by typing looking at them (not at the keyboard) a very long password, and look at the screen, press enter, bam! I am a very good typist! and have great memory too!

@reed that system that I was talking about earlier saved passwords as MD5, no salt, no iteration...

there were 5 users already, and one of them used the Portuguese for password as password...

senha

ok, I have no idea why he's sanitizing the password, for all I know it might not even be a password. The code is totally undocumented, names are not always consistent or descriptive, etc.

anyway, before concatenating the variable in the SQL string, to avoid SQL injection, he seems to be using a couple of functions he created himself

if you don't want to use parametrized queries, at least you should know there's a function called mysqli_real_escape_string... but no, he created two functions

the first is called "characters($title)". It replaces every single quote with two single quotes, and does the same with double quotes. Hmm, good idea. That's going to escape the quotes. Except that he forgot to escape the escape char! Dang

the second function is more interesting. It's called "antihacker($title)"

On a scale from 1 to -1, how fucked is that guy?

The code is like this: $title = str_replace ("SELECT", " ", $title); The same is done with DELETE, UPDATE, TRUNCATE, JOIN, INSERT. Note that the replace is case sensitive, so the function will not replace "select" for example.

@MechMK1, isn't that part of OPSEC? Not letting anyone know?

@reed But how do I get good at OPSEC then?

not talking about it on facebook helps

not asking on a public chatroom helps too

Okay, maybe it's a bit too late to say this, but I have to go. If I don't come back, remember me

@MechMK1 His security is as good as most: security through obscurity.

Truth be told it's unlikely that a "hacker" will manage to take advantage of this, since it will be impossible to figure out what it does. But a disgruntled employee? Game. Over.

@MechMK1 I guess it depends on the specific OP. Good at everything in general is impossible, you (we, everybody) have already make huge OPSEC mistakes since the day you were born.

@reed It all started on the day I was born. They made a document and wrote my name on it. Beginner mistake

I'm smart - we did home births and so didn't file for a birth certificate or social security numbers for any of our kids... The government doesn't even know they exist!

(that would actually be terrible, I didn't actually do that)

You still believe in being born? Pffff, stay asleep then, sheeple