back to article I'm the queen of Gibraltar and will never get a traffic ticket... just two of the things anyone could have written into country's laws thanks to unsanitised SQL input vuln

An SQL injection vulnerability in the Government of Gibraltar's website paved the way for any old Joe to rewrite official web versions of the British Overseas Territory's laws. Security researcher Ax Sharma spotted the vuln while poring over the Gibraltar government's visa rules, which he accessed from the Gibraltar Borders …

  1. KarMann Silver badge

    Exploits of a…

    You may be queen, but Little Bobby Tables is President-for-Life.

    Obligatory XKCD

    1. Anonymous Custard
      Trollface

      Re: Exploits of a…

      If he'd have wanted to scare them, he should have just translated a few of the law docs into Spanish and replaced them...

      1. katrinab Silver badge
        Trollface

        Re: Exploits of a…

        Or a "Government of Gibraltar Act 2020"

        Saying something along the lines of:

        Effective 1st February 2020, Gibraltar will be part of the Cádiz province in Spain. The laws of the autonomous community of Andalusia will apply to the city.

        1. Ordinary Donkey

          That could go further...

          In the event of a no deal Brexit, sovereignty of Gibraltar will pass to the United States of America on payment of six million cans of Budweiser and half a pizza.

          1. A.P. Veening Silver badge

            Re: That could go further...

            I would recommend passing it to Morocco, which will have the option to pass it to Spain when Spain passes sovereignty of Ceuta and Melilla to Morocco.

          2. Rich 11

            Re: That could go further...

            on payment of six million cans of Budweiser and half a pizza.

            In other words, the equivalent value to half a pizza.

  2. phuzz Silver badge
    Thumb Up

    "this section of the website will, in any event, be relocated to an entirely new website."

    Someone finally got the budget for the new site that they've been asking for for years. And all it took was a publicly embarrassing vulnerability.

    (I hope you kept copies of the emails where you told your manager that this would happen, oh unnamed Gibraltarian bofh).

    1. sodium

      and that you deleted the emails where you prompted someone to go probing the site... ;)

  3. Anonymous Coward
    Anonymous Coward

    This is really democratizing the legislative process.

    What's not to like?

    1. Anonymous Coward
      Anonymous Coward

      I vote to '; INSERT INTO NationalLawsContent_Version2webSite (Name, Date, text) VALUES ('Y2K Act', '946684800', 'It is an offence for any person anywhere in the world to post anonymously. Upon convinction on an offence under this section a person shall be sentenced to a fine of no less than €1,000,000. Failure to pay this fine within 30 days shall result in a sentence of not less than 10 years of hard labour without financial compensation. Failure to work hard enough shall be punishable by death.'); DROP TABLE LogEntries_Version2webSite; INSERT INTO LogEntries_Version2webSite (user, IP, Timestamp, Event) VALUES ('Anonymous', '194.60.38.198', 'GET https://google.com/?q=underage+prostitutes'); --

  4. Kubla Cant
    Facepalm

    'Twas ever thus

    I know Gibraltar is a small place, but I'd guess that its utilities such as power, water, drainage and highways are built and maintained by professionals. But when it comes to software, they seem to have entrusted the job to a moderately talented schoolkid.

    1. DontFeedTheTrolls
      Headmaster

      Re: 'Twas ever thus

      But when it comes to software, they seem to have entrusted the job to a moderately talented schoolkid civil servant. Welcome to the world of public services.

      1. Yet Another Anonymous coward Silver badge

        Re: 'Twas ever thus

        civil servant lowest cost bidder (most closely related to senior politician)

        1. defiler

          Re: 'Twas ever thus

          Either lowest cost or closely related. Never both.

    2. Anonymous Coward
      Anonymous Coward

      Re: 'Twas ever thus

      " But when it comes to software, they seem to have entrusted the job to a moderately talented schoolkid."

      or a typically talented web development professional, judging by how often things like this pop up in the news.

      1. Tom 7

        Re: 'Twas ever thus

        Or a Consultant who claims to know some "typically talented web development professionals".

    3. Lotaresco
      Devil

      Re: 'Twas ever thus

      All UKGOV/Territories and dependencies are being forced to reduce the number of contractors they use and to hand over work to civil servants. There's also a recruitment drive to persuade talent to take up a job as a civil servant. This is producing the expected results, the people who actually know how to make things work are leaving/have left. No one with any talent will ditch what they are doing to take a permies salary with the limited holidays, Dilbert pointy-haired boss bullsh*t and general mandarin quackery of the civil service. So the people they have are sitting down with copies of ... for Dummies books and trying to make sense of things. With no actual experience of doing the job the results are predictable.

    4. Anonymous Coward
      Anonymous Coward

      Re: 'Twas ever thus

      Gibraltar may be small but Camelot....

  5. STOP_FORTH
    Joke

    Human input optional

    So if I have a room full of Barbary macaques and keyboards, how long will it take for them to produce the complete works of the Gibraltar Parliament?

    1. Evil Auditor Silver badge

      Re: Human input optional

      How long will it take them to inadvertently hack the laws database of Gibraltar?

    2. Anonymous Coward
      Anonymous Coward

      Re: Human input optional

      "... however, the history of the Internet has shown this to be false."

      1. STOP_FORTH

        Re: Human input optional

        On the Internet nobody knows you are a macaque!

  6. detritus

    How very odd for me that this pops up now - I was just last night staring at a Gibraltarian £1 coin I received as change my last visit there* wondering at the text on Madge's side, confidently asserting "Elizabeth II - Queen of Gibraltar" which as technically true as it may be, made her scope sound a lot titchier, provincial and even moreso diminished than the worst fears of any good Empire-missing Briton might suffer.

    * Conveniently, they're the old-style £1 coins, so utterly useless back in Blighty, except for buying condoms, lube or plastic sex-toys in motorway service stations, which I believe to be the only vendors still accepting them (not that I've tried, I simply read a notice one onesuch machine as I dried my hands at a service station, last time I drove down the M1)

    1. gazthejourno (Written by Reg staff)

      Gib.gov's press office sends its missives out under the name "No.6 Press Office Mailbox". It took me a few minutes to realise that, far from having six separate email addresses, the Gibraltarian government is actually based at No.6 Convent Place, GX11 1AA.

      I assume it's a pleasingly parochial reference to 10 Downing Street.

    2. Chris 239

      Maybe handy

      if you have some old UK pound coins and are visiting Gib - I have a few found down the back of the sofa and in little used trouser pockets.

  7. Chris G

    Queen of Gibraltar

    I have seen and heard him sing in a Karaoke bar in Algeciras.

  8. Ian Johnston Silver badge

    Gibraltar has laws?

  9. oxfordmale78

    The king of Spain is the king of Gibraltar would have done the trick

    Or a law declaring Gibraltar will become part of Spain if the UK ever decide to leave the EU :-)

    1. veti Silver badge

      Re: The king of Spain is the king of Gibraltar would have done the trick

      I was thinking more of a law requiring every able-bodied citizen to report outside the parliament building on 1 April for archery training.

    2. A.P. Veening Silver badge

      Re: The king of Spain is the king of Gibraltar would have done the trick

      Or a law declaring Gibraltar will become part of Spain if the UK ever decide to leave the EU :-)

      To give that a nice twist, have that same law declare that Ceuta and Melilla will become Moroccan on the same day.

  10. J.G.Harston Silver badge

    Stored *by* Parliament. Parliament is a collection of people, not a location.

  11. adam payne

    The spokesman continued: "It should also be noted that the Government of Gibraltar website is hosted outside our corporate network and therefore the earlier vulnerabilities posed no risk to the security of the government's communication systems.

    Good to know but that's not really the point is it.

    1. Anonymous Coward
      Anonymous Coward

      When the prosecutor confirms that the law really does name me specifically as having immunity for this specific offence, I shall also provide this statement comfirming the integrity of the communication containing the countries ratified and in force laws that were received from the official government servers.

    2. Kiwi
      Angel

      Good to know but that's not really the point is it.

      There was a book some years back (title relating to a Cuckoo's egg or similar IIRC) that talked at length about someone who had, in the early days of the internet, been running rampant on uni and military servers due to that wonderful human foible of credential re-use.

      Although I'm absolutely certain no-one involved in this story would ever have used the same creds across multiple servers, no not a chance. Especially not some wanna-be site-admin full of his own sense of the success of his roll-your-own password security!

      [oblig XKCD (and an idea I once wondered about using myself with BBS's back in the 90s :) )]

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like