Security Experts Warn of Increased SQL Injection Attacks

Advertisement (Why?)

Managed IT security services provider SecureWorks announced Tuesday that they have seen a significant rise in the number of attempted SQL injection hacks aimed at some of its financial and utility company clients over the last three months. “From January through March, we blocked anywhere from 100 to 200 SQL Injection attacks per day,” said SecureWorks CTO Jon Ramsey. “As of April, we have seen that number jump from 1,000 to 4,000 to 8,000 per day,” said Ramsey.

“The majority of the attacks are coming from overseas," said Ramsey. “And although we certainly see a higher volume with other types of attacks, what makes the SQL Injection exploits so worrisome is that they are often indicative of a targeted attack.” This is a type of attack where the hacker has targeted a particular organization, versus a worm which spreads indiscriminately.

“The CardSystems security breach, where hackers stole 263,000 customer credit card numbers and exposed 40 million more, is a prime example of a SQL Injection attack,” said Ramsey. A more recent example of a SQL Injection attack occurred last December when Russian hackers broke into a Rhode Island government Web site and stole credit card information from individuals who had done business online with state agencies. The Russian hackers claimed to have stolen 53,000 credit card numbers during this attack.

News source: SecureWorks

“SQL Injection is successful only when the web application is not sufficiently secured,” said Ramsey. “Unfortunately, the majority of websites and web applications are not secure. Thus, we are advising all organizations to use ‘input validation’ for any form to ensure that only the type of input that is expected is accepted.”

Additionally, it is important to note that protecting against a SQL Injection attack also requires organizations to not only protect their web applications but also the web server on which the web application is running, the database from which the web application is retrieving information, and the operating systems upon which the web servers, applications and database reside.

“A SQL Injection attack is certainly not a new form of attack or the most sophisticated type of attack; however, as illustrated, it can be quite malicious so we are advising all organizations, with an Internet presence to take their web application security very seriously,” concluded Ramsey.

#1 madnuke on 19 Jul 2006 - 15:19

Yes I saw this on SANS-ICS today, not looking good at the moment.

(2 replies) #2 Stunna on 19 Jul 2006 - 15:40

So how do these injections work?
How are governmenet sites getting hacked, I thought they were suppose to be some of the most secured sites?
I wonder how credit card companies are handling this.

#2.1 clonk on 19 Jul 2006 - 16:10

This will give you a good overview on how SQL injection is done.

http://en.wikipedia.org/wiki/Sql_injection

#2.2 lbmouse on 19 Jul 2006 - 17:16

Here are a couple of sites that will take you through a "walk through" of injection attacks for beginners:
http://www.unixwiz.net/techtips/sql-injection.html
http://www.securiteam.com/securityreviews/5DP0N1P76E.html

In my opinion, there are only two reasons why injection attacks are even a concern: lack of knowledge and laziness. If I catch any of my guys sending a user entered value to the database w/o at least some validation and cleansing, they are gone.

(1 reply) #3 neufuse on 19 Jul 2006 - 15:50

well its a good thing all .NET websites are automatically protected against some types of injection attacks that are based on ASP.NET version 1.1 and newer... they automatically reject any code at least all cross site scripting attacks and a lot of SQL injection ones (but not all, depends on how they formatted the text) but its better then nothing

#3.1 mrbester on 20 Jul 2006 - 09:21

Really? I think I'll stick with something I do rather than relying on an "automatic" protection, even if what I do is specifically call the protection (like in PHP)

(1 reply) #4 Magallanes on 19 Jul 2006 - 17:35

If characters entered by the users not in (A-Z,a-z,0-9, space, comma, point) then replace this character by a "_" or reject this entry.

Even a non-pro webpage can put a single protection again sql injection. I don't believed that a security webpage will forget to do it. IMHO security breach are in 99.9% internal affair.

#4.1 mrbester on 20 Jul 2006 - 09:14

And what about the valid apostrophe character? That's the easiest injection attack vector, but people insist on names like O'Brien which need to be stored. Simply using [^A-Z0-9s,.] leaves out loads of useful characters (how about a colon?)

#5 thunderbird_117 on 19 Jul 2006 - 17:55

SQL injection is easiest way to attack. It the most frequently used attack world wide.

#6 p1p3 on 19 Jul 2006 - 18:11

If you don’t protect yourself against something as simple as a SQL injection attack then you have no business programming webpages and deserve to get hacked. Maybe you will learn until next time...
Always assume user input is contains error or is malicious and always check it, ALWAYS!

(1 reply) #7 chconline on 19 Jul 2006 - 18:48

alright everyone, let's move back to plain old HTML.

#7.1 Colin-uk on 19 Jul 2006 - 21:19

even better lets use pen and paper

although then i guess you are vulnerable to cut and paste attacks, but you can usually tell by the big blobs of pva around the sides

(1 reply) #8 mkennedy150 on 19 Jul 2006 - 21:42

My gaming site has been hit twice by a turkish hacking group called the cyber-warriors there official website is at www.cyberwarrior.org...both time by SQL injections.

#8.1 Stunna on 19 Jul 2006 - 22:15

LOL at them having their own website.
Do most hackers groups have webpages?

Does anyone know how I can read this website using some type of online language converter?

(1 reply) #9 carlskov on 20 Jul 2006 - 11:15

It's so easy to avoid SQL injections... But I've known a lot of programmers who were very talented, but who had never heard of SQL injection.

If you're creating your SQL statement manually, just remember to replace single apostrophe ( ' ) with two of them...

i.e. VBScripts function Replace(): strValue = Replace (strValue, "'", "''"

If the field is supposed to be numeric, then check that the value is infact numeric.

#9.1 mrbester on 20 Jul 2006 - 13:38

I'll see your "replace quotes" and raise you a "send in an escaped quote" (quite a few databases support this):
For MySQL, send in <backslash>'; DROP TABLE users; --
Replace() returns <backslash>''; DROP TABLE users; --
SQL becomes "... WHERE field='<backslash>''; DROP TABLE users --'"

or you could try a Unicode or other encoding...

Edit: backslashes were removed by the comment system

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Neowin.net