Terrible Web Development Practices - Need help with this

A

arkonza

Member
Joined
May 11, 2010
Messages
22
Reaction score
0
Location
PTA
Hi all,

I need some opinions on this:

I recently found the following security issues in a website done for a shop

- SQL queries were being displayed to the user at the top of the results page after they used the search function
- There was no sanitization, so you could pass SQL queries to the database at your leisure

I contacted the shop and warned them of the issues, without slating the development company in question. However a representative from the development company happened to be at the shop the day after I send the email and ... :

1. felt the need to be cocky about it... slagging me off ie that I think I'm such a hacker
2. Downplayed it to the customer saying... it's not a bank so its not feasible to focus on stuff like that
3. Did not take ownership of the hugely unprofessional workmanship and apologize to the customer

The above 3 points I heard from people that were there at the time.

What does this say about a company that boasts about custom CMS sites and having done sites for the government on their clients page. Actually quite a few of the sites listed on their client page seemed to have moved away or some that are actually with them have quite a few error pages scattered among their respective links that describe the server and php versions quite nicely for anyone wanting to exploit it.

My view of this:
(I create systems that handle sensitive and mission-critical data for companies that use web technologies for their frontends)

Validation and Sanitization should be at the core of any web development... I have my own engine that scales to the size and usage of the site, and validates everything, it is also very customizable. It catches everything the client-side validation misses so if a designer is hired to redo the site design and doesn't validate properly... the engine still handles it appropriately. The engine also catches errors and blatant hacking attempts, alerting my admin panel that holds stats on all my deployed sites. Any freelance work I do has this engine for free as I feel security is not a separate issue to development... before I even start a freelance site the security gets put in place and is implemented throughout my code. I monitor security news and test my own sites against exploits even if the client doesn't have an SLA with me. (for the testing I keep local copies and will contact the client if I feel the LIVE site needs testing)

I am VERY OCD with my code, it is my creative outlet and having my sites and code out there feels like I'm letting someone look into my soul... so I am very thorough and stringent with what I produce. Am I too harsh with my view of what a charging, 'Professional' company (who's bread-and-butter is web development) should be supplying to their clients?

Thanks,
Arky
 
If you have SQL injection vulnerabilities in 2012 then you're clueless. Run, run far away ...

Name & shame.
 
lol ponder, I will most likely name & shame shortly... I don't like having to do this, I'd prefer it if people would take ownership when mistakes come to light.

I would like to get a professional opinion in from someone that isn't directly involved in the dispute, biometrics seems to qualify for this and I agree whole heartedly with his post...
 
Name and shame and if the website owner does not take these issues seriously (especially if the process online payments via credit card), tell the acquirer or the payment gateway that the side in question exposes several vulnerability.

Did the same with an online bookstore which was recommended by my son's school and after a "nice" email to the headmaster (and a subsequently highly pissed off developer) the problem was fixed quickly... A name&shame on Twitter, Facebook and Hellopeter does wonders in such instances.

Sadly the customer paid probably a lot of money for an inferior and sloppy product delivered...

where is the link to the website?
 
This is the development company in question :

http://www.bluegate-it.co.za/

The specific client in question hasn't been added to their client list yet, I won't paste the shops website as I think it is unfair if they get hacked because of this thread... I have screenshots of the shoddy workmanship in all it's glory so if you are reading this BlueGate please don't try deny the severity of the flaws.
 
MagicDude4Eva said:
Name and shame and if the website owner does not take these issues seriously (especially if the process online payments via credit card), tell the acquirer or the payment gateway that the side in question exposes several vulnerability.
Click to expand...

This
 
I will speak to the website owner again first, I think initially it is the norm to trust the person you have started a business relationship with over some guy who just emailed a comment... the shop owner most probably doesn't understand what we are talking about and extends the trust to BlueGate to clarify all this.

I just don't think the owner has had a chance to see this in perspective of the potential damage to clients and PR of the shop.

Again, shame on BlueGate for downplaying it.
 
Thanks for the help so far guys,

I'm quite angry with BlueGate, about their code and the way they handled it... I can be quite harsh sometimes so I wanted to get input from people who were not directly involved so that I would name them out of reason and not anger.
 
Mike Hoxbig said:
Also,
The merger and the establishement of Bluegate was a success and we have grown from a small 2 man operation to a streamlined 6 person establishement.
That's a 200% growth, yo! :eek:
Click to expand...

rofl... I didn't even see that one
 
o0

2. Downplayed it to the customer saying... it's not a bank so its not feasible to focus on stuff like that
Click to expand...
WTF.... I've never come across a client that doesn't care about the security of their customers' information.
I've even had a client where I had to encrypt files that customers uploaded (which I think is good, btw).

I've had one client's site uhm... compromised once, ages ago, where I neglected to sanitize an input (luckily the person to find that, didn't compromise data, but just highlighted the error). Believe me I've not made that mistake since then.
Displaying SQL statements to the users is a very very big no-no. I know UNISA's website had a few debug glitches where I could see the debug sql statements.... I was appalled.

And anyways, how much work is it to sanitize queries and hide debug info? Pfft.

If I was a client looking for a prospective development company, this company would drop right to the bottom of my list. No, stuff that. They've dropped off the list.
 
froot said:
And anyways, how much work is it to sanitize queries and hide debug info? Pfft.
Click to expand...

Pretty much summed up how I feel in your whole post there. Ja I don't know, now I'm wondering did they lie and downplay because they don't care... or to them is it actually such a mammoth task to write secure code
 
arkonza said:
Pretty much summed up how I feel in your whole post there. Ja I don't know, now I'm wondering did they lie and downplay because they don't care... or to them is it actually such a mammoth task to write secure code
Click to expand...

:D

Indeed.

Secure code is "hard" in the beginning and soon after becomes a)pride and b)habitual. It's supposed to be standard practice and standard to absolutely any SQL queries (and actually all forms too).
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X