Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
IT Security ToolsGitHub Release: google/clusterfuzz v2.41.2 (24.09.2026)(24.09.2026 um 14:57 Uhr)
IT Security NachrichtenNew Browser Guard features add protection before and after you click(24.09.2026 um 14:45 Uhr)
IT Security NachrichtenMeta brings Private Processing privacy protections to AI glasses(24.09.2026 um 14:44 Uhr)
IT Security NachrichtenTesla FSD Fails Belgian Safety Tests(24.09.2026 um 14:56 Uhr)
Sicherheitslücken (CVE)CISA Charts New "Quality Era" for Global CVE Program(24.09.2026 um 14:50 Uhr)
IT Security NachrichtenThe cost of intelligence?(24.09.2026 um 15:00 Uhr)
IT Security ToolsGitHub Release: google/clusterfuzz v2.41.2 (24.09.2026)(24.09.2026 um 14:57 Uhr)
IT Security NachrichtenNew Browser Guard features add protection before and after you click(24.09.2026 um 14:45 Uhr)
IT Security NachrichtenMeta brings Private Processing privacy protections to AI glasses(24.09.2026 um 14:44 Uhr)
IT Security NachrichtenTesla FSD Fails Belgian Safety Tests(24.09.2026 um 14:56 Uhr)
Sicherheitslücken (CVE)CISA Charts New "Quality Era" for Global CVE Program(24.09.2026 um 14:50 Uhr)
IT Security NachrichtenThe cost of intelligence?(24.09.2026 um 15:00 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

CodeSOD: Three Minutes

Angela's team hired someone who was "good" at SQL. When this person started, the team had some regular jobs which ran in the mornings. The jobs were fairly time consuming, and did a lot of database IO. When their current database person…

0
↗ Quelle (thedailywtf.com)
Reagiere als Erste:r — dein Feedback zählt!

Angela's team hired someone who was "good" at SQL. When this person started, the team had some regular jobs which ran in the mornings. The jobs were fairly time consuming, and did a lot of database IO. When their current database person left for another job, they hired someone who had a "good grasp" on SQL. We'll call him Barry.


Barry started out by checking the morning jobs every day. And over time, the morning jobs started getting slower and slower. That was a concern, but Barry swore he had it under control. Barry did not share that a handful of slow queries- queries which took three or so minutes to run- had suddenly started taking 75+ minutes to run. Barry didn't think about the fact that a little time with the query planner and some indexes could have probably gotten performance back to where it should have been. Barry saw this problem and decided: "I'll write a Python script".


import time
from datetime import datetime, timedelta
import pytz # for time zone

current_date = datetime.now()
day_number = current_date.weekday() # integer value: 0 is Monday
hub_1_ready = False
hub_2_ready = False
hub_1_results = []
hub_2_results = []
job_ran_later = False # If this job is manually run later in the day, avoid sending a "both hubs failed" email



# Monday (day_number 0) runs later than the other 6 days
if day_number == 0:
end_time = datetime.strptime("08:30", "%H:%M")
end_time = end_time.time() # get just the time portion
else:
end_time = datetime.strptime("07:30", "%H:%M")
end_time = end_time.time() # get just the time portion

# If this job is run later in the day than the normaolly scheduled time
if datetime.now(pytz.timezone('US/Central')).time() > end_time:
job_ran_later = True


# Starting when Morning jobs are scheduled to kick off, check for completion of both hubs every 3 minutes until end_time. If both hubs are not a Success by end_time, an email is sent
while datetime.now(pytz.timezone('US/Central')).time() < end_time:
h1 = session.sql("SELECT LOG_STATUS FROM PROD_CTRL.CTRL.DRB_EXECUTION_LOG WHERE LOG_PROJECT = 'SRC_PROD_1' AND date(log_start_date) = current_date AND date(LOG_END_DATE) = current_date").take(1)
hub_1_results = []
hub_1_results.append(h1)
if str(hub_1_results[0]) == "[Row(LOG_STATUS='SUCCESS')]":
hub_1_ready = True


h2 = session.sql("SELECT LOG_STATUS FROM PROD_CTRL.CTRL.SRC_EXECUTION_LOG WHERE LOG_PROJECT = 'SRC_PROD_2' AND date(log_start_date) = current_date AND date(LOG_END_DATE) = current_date").take(1)
hub_2_results = []
hub_2_results.append(h2)
if str(hub_2_results[0]) == "[Row(LOG_STATUS='SUCCESS')]":
hub_2_ready = True


# If both hubs are Success, then break out of while loop, even if it's not end_time yet
if hub_1_ready == True and hub_2_ready == True:
break

time.sleep(180) # Sleep for 3 minutes before trying again




if not hub_1_ready and not hub_2_ready and job_ran_later == False:
message = "Neither Hub_1 nor Hub_2 finished in time for Morning jobs."
context.updateVariable('METL_MESSAGE', message)
raise ValueError("send email: "+message)
elif hub_1_ready == False and hub_2_ready == True:
message = "Hub_1 did not finish in time for Morning jobs."
context.updateVariable('METL_MESSAGE', message)
raise ValueError("send email: "+message)
elif hub_1_ready == True and hub_2_ready == False:
message = "Hub_2 did not finish in time for Morning jobs"
context.updateVariable('METL_MESSAGE', message)
raise ValueError("send email: "+message)
elif job_ran_later == True:
message = "This job was run manually later in the day. Check that both Source hubs have completed. If you did not run this job, you can probably ignore this email."
context.updateVariable('METL_MESSAGE', message)
raise ValueError("send email: "+message)

I don't particularly like any of this. Some of it is just little ugliness, like the fact that job_ran_later and the closing if statements could be written to be much more clear. Or the way that, after our main while loop, which we'll come back to, we compare boolean variables against boolean literals.


The core of it is the while loop, which checks the current time, and while it's before the target end time, it runs a pair of queries. For each query it runs, it empties an array, then append the results (which we know is only one value, because they take(1)) to the array. Then they check the first element of the array against an expected string.


Why the arrays? Who knows. Perhaps at one point they thought they'd keep the results from multiple iterations, then decided against it. Why do the check against the string in the Python code and not the query? No idea, but maybe I don't have a "good grasp" of SQL. That said, with my bad grasp, I'm pretty sure I could figure out how to do all that in one single query and not two that are almost identical.


In any case, if we don't see what we want in the database, we sleep for three minutes, then try again.


At the end of the process, we check what happened and output messages and raise exceptions based on what we did see in the database.


It's also worth noting that Angela's team used a pretty reasonable job management system. All of their other scripts doing similar jobs didn't include retry logic inside themselves- they just failed. That let the job runner decide whether or not to retry, and that allowed all sorts of valuable configuration options that are more fine grained than "sleep for 3 minutes".



[Advertisement]
BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!

SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - CodeSOD: Three Minutes
id: 31e68303-f794-4da6-8435-02591b5faf21
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "CodeSOD: Three Minutes" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich CodeSOD: Three Minutes.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten CodeSOD: Three Minutes

Thematisch verwandte Begriffe: CodeSOD, Three, Minutes · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97152 | Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploi…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick