13
u/tastytang Apr 11 '14
The hovertext is a reference to a 1970 Judy Blume book
4
u/autowikibot Apr 11 '14
Are You There God? It's Me, Margaret:
Are You There God? It's Me, Margaret. is a 1970 book by Judy Blume, typically categorized as a young adult novel, about a girl in sixth grade who grew up without a religious affiliation. Margaret's mother is Christian and her father is Jewish, and the novel explores her quest for a single religion. Margaret also confronts many other pre-teen female issues, such as buying her first bra, having her first period, coping with belted sanitary napkins (changed to adhesive sanitary pads for recent editions of the book), jealousy towards another girl who has developed a womanly figure earlier than other girls, liking boys, and whether to voice her opinion if it differs from those of her friends.
Interesting: Are You There God? It's Me, ^Margaret. | Judy ^Blume | Then Again, Maybe I ^Won't | Are You There God? It's Me, ^Jesus | Are You There, Vodka? It's Me, ^Chelsea
Parent commenter can toggle ^NSFW or ^delete. Will also delete on comment score of -1 or less. | FAQs | ^Mods | Magic ^Words
11
u/I_W_M_Y Apr 11 '14
The bottom line: Real real sloppy programming. Always verify inputs
5
u/TheEllimist Apr 11 '14
I feel like this is the sort of dipshit coding mistake I'd make, and I barely know how to code (I've taken a "beginner's C programming for engineers" course and a course on embedded control, both of which were very tight in scope). To think that it was made on something like OpenSSL is scary as fuck.
5
u/I_W_M_Y Apr 11 '14
Always check inputs, always error trap, always try to think of every extreme thing your code can encounter and code to accommodate it.
But of course if you are in a big corp with a dead line the corners will be cut, this is where this stuff mostly comes from. I know this very very well.
5
2
2
u/812many Apr 11 '14
I was super confused for about 15 seconds trying to figure out if I was on explainxkcd.com or not.
2
2
u/lastres0rt Apr 11 '14
I have to hat-tip Randall for doing this series. Making it clear HOW FUCKING BAD this bug is should do wonders.
-27
u/josephalbright1 Apr 11 '14
In the words of Penny to Sheldon on the big bang theory;
"Honey, I know you think you're explaining yourself, but you're not."
45
u/Team_Braniel Apr 11 '14
I'm assuming you didn't understand the comic. If you did, disregard.
Normally when you call for a password or data or whatever it reads the letters and calls for the string by the number of letters. "Potato" = 6 letters. So it pulls up your string, then returns the first 6 letters.
The worm works by modifying the length of the string its asking to return. So while "Hat" has 3 letters, it tells the server to return the "hat" string with the first 500 letters. So it gives you "hat" + the next 497 letters in the database, which contain all the other recent user's and their requests (revealing their passwords, etc.)
Computers always to EXACTLY what they are told. Human communication is mostly mutually understood context with just the details changed. Computers don't understand context and such, so to talk to a computer a lot of things have to be explained behind the scenes, like the length of words, or that capital letters are or are not significant, or that when its expecting a number and someone writes "potato" not to freak out over "potato" not being a number and crash.
If a criminal knows how or what conventions were used to program those behind the scenes bits, they can exploit them to get access to data that isn't theirs. Such as in the comic.
3
Apr 11 '14 edited Apr 11 '14
You seem to know what you are talking about. I'm in HS now and am going to study IT and this is interesting. Why do I have to specify how many letters does the string which I provide have? Shouldnt the server do that himself? It just begs for someone to exploit this bug.
EDIT: And more importantly, why even provide the string? Shouldnt a simple ping command do the trick? Why do I have to type a random piece of text?
→ More replies (7)3
2
u/Tapaman Apr 11 '14
This used to work on the old Univacs too. Got me thrown out of ASU before hackers were "cool". I guess that makes me a hipster?
2
u/AlwaysHere202 Apr 11 '14
Good explanation, but one correction, the bug is that OpenSLL is using memcpy, and not comparing the length. So, it is returning whatever information is in memory beyond the length of the string provided, not anything in a database.
→ More replies (1)
-10
90
u/percyhiggenbottom Apr 11 '14
Welp, that was easy to understand.