Can you spot any problems in this code? (Java)

[DJKNIGHT123]

Some background info if it will help you or not...

A payment app was aquired by a bank. During data center migration, there was a data breach and information was leaked by hackers BEFORE the data centers migrated to the bank.

The code provided is from the key area of authentication of the app.

HERE'S THE CODE:





Any help will be appreciated thanks!!

[2kaud]

I'm c++ not java, but a couple of general points. It looks like you are storing clear-text passwords and passing clear-text passwords as arguments to functions. That's really a no-no. The passwords should be encrypted as soon as they are entered and only the encrypted form stored and passed between functions. Once encrypted, the memory used to temporarily hold the clear-text password should be overwritten. Comparisons are then made between the encrypted paswords.

What if the entered username and/or password contained SQL statements? I'm not an SQL expert but I know that you can 'embed' SQl in data passed to an SQL query. As well as storing passwords encrypted (meaning that the entered text is changed), user-names also are not stored as 'plain text' but undergo a (reversible?) transformation so that again any embedded SQL wouldn't work.

[DJKNIGHT123]

I'm c++ not java, but a couple of general points. It looks like you are storing clear-text passwords and passing clear-text passwords as arguments to functions. That's really a no-no. The passwords should be encrypted as soon as they are entered and only the encrypted form stored and passed between functions. Once encrypted, the memory used to temporarily hold the clear-text password should be overwritten. Comparisons are then made between the encrypted paswords.

What if the entered username and/or password contained SQL statements? I'm not an SQL expert but I know that you can 'embed' SQl in data passed to an SQL query. As well as storing passwords encrypted (meaning that the entered text is changed), user-names also are not stored as 'plain text' but undergo a (reversible?) transformation so that again any embedded SQL wouldn't work.

I thank you for your input.

Your first point makes sense, I get that. However your second point about SQL statements, I didn't quite catch that. Could you perhaps rephrase it somehow...I'm trying to figure it out, seems a bit too complex for me xDD

[2kaud]

However your second point about SQL statements

See https://en.wikipedia.org/wiki/SQL_injection

Like I said, I'm not an SQL expert - but we never use any entered data directly.

[Norm]

Also posted at: http://www.dreamincode.net/forums/to...s-in-the-code/