• On TV.com: Sexy summer bodies photo gallery
April 7, 2008 12:29 PM PDT

A funny thing happened on the way to RSA registration...

by Robert Vamosi

Want to cause trouble at RSA? Register with any of a number of special characters in your name or business name and watch the badge printer issue blanks. That's what happened to me.

Monday morning when I registered for RSA 2008 (where I'll be speaking with Chris Boyd of FaceTime), I thought maybe I'd get a little VIP service. (Our talk on "How to Adapt to the Echo Generation's Social Media Hacking Game" is at 9:10 a.m. PDT on Thursday.) Instead, I was stuck in various registration lines for more than half an hour until the lone IT guy realized the system wasn't handling special characters in my company's name. In other words, the registration at RSA could be vulnerable to SQL injections, where special characters cause the database system to behave differently.

After typing in my name and confirming my registration at the little kiosk near the door, I walked over to the printer desk, where I should have had my badge waiting. Instead, the first badge came out blank. As did the next, and the next after that. For the next 20 minutes, as different desk clerks tried to help me, there were about a dozen attempts to print out my badge--all blank. Apparently there's only one IT guy and he immediately realized that whoever registered me as a speaker used the pipe character in CNET, a style we stopped using years ago. The pipe character in most SQL systems is used to indicate a concatenation.

But I'm not alone. Security researcher Adam J. O'Donnell reports that even the apostrophe in his last name caused the system to bonk. O'Donnell humorously (or maybe not) adds that "RSA is attempting to segregate out the Irish without posting an 'Irish Need Not Apply' sign."

Are there any other special character examples from RSA 2008 attendees? Post a note below.

As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.
advertisement
Click here!
Recent posts from Defense in Depth
Window Snyder to leave Mozilla
How to handle ID fraud's youngest victims
Is white listing going mainstream?
How Live OneCare changed the antivirus landscape
Express Scripts clients threatened with extortion
Study: DDoS attacks threaten ISP infrastructure
Security expert talks Russian gangs, botnets
Extortion used in Express Scripts database breach
advertisement

Making sense of Windows 7 upgrades

faq The basics and the fine print on Microsoft's options for those eyeing the next operating system from Redmond.
• Full Windows 7 coverage

Road Trip 2009: Big Sky Country

CNET News reporter Daniel Terdiman takes his car full of gadgets to the Rockies and the Great Plains in search of tech, science, nature, and more.
• America's Fortress: Cheyenne Mountain

About Defense in Depth

Covering computer viruses and computer crime, Robert Vamosi goes beyond the hype to provide you with expert interviews of the top security researchers, as well as offering the hands-on, nontechnical advice you'll need to stay safe online.

Add this feed to your online news reader

Defense in Depth topics

advertisement
advertisement
Click Here

Inside CNET News

Scroll Left Scroll Right