Forgot your password?
typodupeerror
Censorship Red Hat Software Security Linux

Fedora Project Drops SQLNinja 'Hacker' Tool 159

Posted by kdawson
from the dual-use dept.
simonb writes, "In what can only be described as a fit of insanity, the Fedora Board have declared a 'hacker tool' not fit for entry into their software repositories. Today your SQL injection tools, tomorrow your nmap?" The Register links the Fedora board's meeting minutes. From the story: "The move came on Monday in a unanimous vote by the Fedora Project's board of directors rejecting a request that SQLNinja be added to the archive of open-source applications. It came even as a long list of other hacker tools are included in the bundle and was harshly criticized by some security watchers. 'It seems incredibly short sighted to reject software based on perceived legal usage,' said Jacob Appelbaum, a full-time programmer for the Tor Project. 'They have decided to become judges of likely usage based on their own experience. That is a path of madness.' ... [T]he board unanimously decided to add a new statement to Fedora's legal guidelines concerning the inclusion of hacking tools. ... Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks."
This discussion has been archived. No new comments can be posted.

Fedora Project Drops SQLNinja 'Hacker' Tool

Comments Filter:
  • by Anonymous Coward on Saturday November 13, 2010 @02:50PM (#34216688)

    Oh wait.

    Who cares if X or Y is left out of a distro? If it's available, it's installable.

  • by fotbr (855184) on Saturday November 13, 2010 @02:54PM (#34216720) Journal

    If you don't like the way we do it, do it yourself.

    Isn't that kind of the point of things being open? That you don't have to agree with the way things are done -- you have the source, change/fix/fork it yourself.

    In other words -- non-story. Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.

  • by Beelzebud (1361137) on Saturday November 13, 2010 @02:59PM (#34216748)
    I swear, some people really need to read about the concept of censorship. I wasn't aware that Fedora was a government entity, and that they just banned an app from ever being used.

    Guess what. You can always install this app yourself, if you really want to use it. I'm sure someone wanting a hacking tool can figure out how to install software...
  • by Anonymous Coward on Saturday November 13, 2010 @02:59PM (#34216752)

    Then the question becomes: "Why use a distribution at all? Why not compile everything from scratch?"

    The answer is: convenience.

    Leaving out any useful tool is just stupid. If you want to leave out the slirp package, that's understandable. People actually use this tool though.

  • Exaggerate much? (Score:5, Insightful)

    by Reaperducer (871695) on Saturday November 13, 2010 @03:13PM (#34216844)

    "In what can only be described as a fit of insanity"

    Holy crap. Get some perspective. It's not that big a deal. Go outside and get some fresh air and sunshine.

  • by phantomfive (622387) on Saturday November 13, 2010 @03:18PM (#34216868) Journal
    The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?). SQLNinja is marketed entirely as an "SQL Server injection & takeover tool." Obviously marketing isn't the most important thing, but penetration testing is about all it can do (unless you're dumb and actually want to take over other people's computers). Fedora users aren't primarily penetration testers.

    From reading the minutes, it seems like the Fedora board rejected it, not because it's a hacker tool (they include jack-the-ripper), but because it doesn't provide any real benefit for their customer base, certainly not enough to outweigh the small legal risk entailed. Fedora isn't a penetration testing distro, it's a server distro. They don't include metasploit either, there's just no demand for it, and the authors of metasploit don't need to get attention for their product by begging people to put it in their distro.
  • by ScrewMaster (602015) * on Saturday November 13, 2010 @03:58PM (#34217046)

    If you don't like the way we do it, do it yourself.

    Isn't that kind of the point of things being open? That you don't have to agree with the way things are done -- you have the source, change/fix/fork it yourself.

    In other words -- non-story. Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.

    True. The net effect of the Board's decision, so far as people actually using said tool, will be nil. My guess is that this is some kind of "cover their collective asses" move, over perceived liability for distributing such software. Given the current legal climate in many countries towards "hacking" tools (doesn't Germany take a rather hard line there?) they may actually have a legitimate concern. I don't know, not a lawyer, etc. etc.

    Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.

    There really should be no "stance", in that sense. They're blaming the tools here, not the users of those tools. If a piece of software can be used to test a network for vulnerability, it can likely be used to penetrate said network. And to that I say ... so what? Do some people not understand the concept of a double-edged sword? Not to mention the fact that the only way security people can test their protective measures is by using many of the same software tools used by blackhats, and if you remove them from the hands of security people you will find that the crooks will still have them. So you really can't make a distinction between legitimate and illegitimate tools, only legitimate and illegitimate uses..

    Many handtools can be used to stab someone to death: but nobody who sells tools thinks "gee, maybe we should refrain from selling screwdrivers and only offer blunt tools with no sharp edges."

  • by phantomfive (622387) on Saturday November 13, 2010 @04:13PM (#34217112) Journal
    Good job. You have demonstrated your capability to read, cut and paste a sentence from the minutes onto slashdot. Do you also have the capability to explain why you think that sentence is particularly important? Please do.
  • Fine Lines... (Score:3, Insightful)

    by Improv (2467) <pgunn@dachte.org> on Saturday November 13, 2010 @04:16PM (#34217136) Homepage Journal

    Being reasonable requires we be willing to draw lines and pass judgement. There are some tools that are mostly legitimate, some that see substantial illegitimate use, and some that are mostly illegitimate. It's fine for a Linux distro to decide not to ship with (or include in repositories) tools that are mostly used for illegitimate ends, even if they have some theoretical legitimate uses. They're not under any obligation to package everything, and "stuff that's mostly used to do harm" is just as reasonable to filter out as "things with ugly licenses".

    By analogy, it is usually hard to get lockpicking tools, assault weapons/vehicles, nuclear materials, radar detectors, unsafe foods, homemade alcohols, and many other things in most countries. Can you manage it? Usually, either by legitimate means if you can get a permit, or by making them yourself.

    This is entirely different (and much more mild) than blacklisting those applications.

  • by dieth (951868) on Saturday November 13, 2010 @04:26PM (#34217198)

    Because _distributing_ Free software is the distribution's job. The developers should only make the source available and let any distros that want it package it themselves.

    I believe they just said they don't want it.

  • by fluffy99 (870997) on Saturday November 13, 2010 @04:28PM (#34217204)

    You may be right, but it would be especially ironic since if those companies would have had ninjaSQL, and used it effectively in testing their networks, then they wouldn't have been a victim of SQL exploits in the first place...

    This isn't a tool to find vulnerabilities. It's a tool to exploit them once found.

    From the sourcforge page for this tool

    "Sqlninja's goal is to exploit SQL injection vulnerabilities on web applications that use Microsoft SQL Server as back end. It is released under the GPLv2.

    There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network. In a nutshell, here's what it does: "

    As you probably have figured out, sqlninja does not look for SQL injection vulnerabilities. Again, there are already several tools that perform that task already.

  • by fluffy99 (870997) on Saturday November 13, 2010 @04:35PM (#34217234)

    The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?).

    Yes of course, but there are also plugins for e.g. nmap that will give you 'recommendations' for _said_ open ports on target which in the end is also a 'penetration tool' which was one of the reasons for not adding this particular package. So how is that so much different ?

    Because the sole purpose of SQLninja is to exploit a SQL injection vulnerability once detected by other means, not to actually discover them. To me, that is a black hat tool with no redeeming use as a pen testing program.

  • by dbialac (320955) on Saturday November 13, 2010 @05:27PM (#34217492)

    As a white hat developer, I've found tools such as nmap, wireshark and tcpdump useful in my daily life. While I can see that this tool can be used by security researchers, I cannot imagine a scenario where I would use a tool such as this one. Forget about the security objections of Fedora. On its own, this tool is a highly specialized utility. It is not something the everyday user or developer really needs.

  • by your idea (Score:0, Insightful)

    by chronoss2010 (1825454) on Saturday November 13, 2010 @06:49PM (#34217868)
    so if someone gets hit over head with a hammer is Canadian tire liable for selling them the hammer?
  • by mrphoton (1349555) on Saturday November 13, 2010 @06:56PM (#34217898)
    Why are these guys surprised that a project backed by a company rejected there hacking tool. Firstly the name 'sqlninja', I mean come on, it's got to be a hacking tool, can you imagine that on the front page of a news paper 'evil open source firm ok's sqlninja'. Then when I googled it, the website declares it is a 'sqlninja - a SQL Server injection & takeover tool'. In no way do they pretend it is for testing or whatnot. They had to reject the tool. And what business is red hat in, oh year selling a server os, would it really be a good idea for them to bundle a 'takeover tool'?
  • by Anonymous Coward on Saturday November 13, 2010 @07:01PM (#34217932)

    I'm afraid that I don't understand your point. Are you saying that, because this isn't a program that just goes "oh look, I think I found a vulnerability" but actually exploits it, that it's any less valuable to someone in charge of network security?

    "Oh look, you left your computer logged on" versus "Oh look, you left your computer logged on. I think I'll empty your bank account to prove you shouldn't do that". No it's not useful to someone trying to improve security.

  • Re:Fine Lines... (Score:1, Insightful)

    by Anonymous Coward on Saturday November 13, 2010 @08:05PM (#34218432)

    The thing I like about Unix is that everything is designed to give me more power. No "Oh, you can't do that because you might hose your computer." or "You can't have that because you could use it for hacking!". If I want something done, my computer damn well does it.

    From this perspective, rejecting a package from a repository because it gives the user the wrong sort of power is an alien concept. Fortunately, the idea of open source is that something like this is never permanent - it lasts only until someone includes the package in a competing repository.

  • by Zero__Kelvin (151819) on Saturday November 13, 2010 @09:15PM (#34218882) Homepage

    "This isn't a tool to find vulnerabilities. It's a tool to exploit them once found."

    How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?

"It is easier to fight for principles than to live up to them." -- Alfred Adler

Working...