Stopping automated SQL injection attacks

By Jamie Gamble and Patrick Szeto | May 8, 2009

0 comments

Facebook

LinkedIn

Digg

SQL injection is a class of vulnerabilities that arises when user-supplied input is used to construct SQL queries, or commands designed to modify and manage databases. If the user-supplied input is not properly sanitized prior to being appended to a dynamic SQL statement, an attacker can modify the query to produce results not intended by the developers. The modified SQL statement can perform any of the actions that are available to the database account's privilege level, both on the database and to the system and network that the database is running on.

In 2008, worms were used to compromise Web servers and install malware that infected users of the affected websites. The worms used automated SQL injection attacks to modify the data in the database that would be displayed to users as part of a webpage. The modified data would be loaded into webpages, redirecting the user to another site hosting malware. In this tip, we'll look at ways to prevent these automated hacks.

The way that a payload is executed in the user's browser makes the attack similar to persistent cross-site scripting, an exploit in which a hacker places malicious code into a link that appears trustworthy. The difference is that the malicious executable injected during automated SQL injection attacks may be found in many different portions of the site, and not just in locations where the response includes previously supplied user input, as is the case with cross-site scripting. When a user browses to a page that includes the contaminated data, he or she will be redirected to a page that will download malware onto the local computer.

Automated SQL injection, with the help of search engines
These automated SQL injection worms utilize search engines to discover candidates for attack. By searching for strings associated with parameters for Web applications, the worms capitalize on search engines to acquire targets. The worms may search for specific page names such as "form.asp" or form parameter names such as "username." These identify Web forms and are commonly vulnerable to SQL injection. Search engines like Google also provide advanced search options such as "inurl:", "allinurl:" and "site:", which enable the worms' programmers to specify how to search for these parameters, such as in a search for "inurl:username=". The worms then launch SQL injection attacks to compromise the identified sites. By attacking Web servers that appear to access a database, the worms do not waste time attacking Web servers that don't have dynamic content. This allows them to spend less time randomly scanning for targets to exploit, allowing them to spread faster.

0 comments

Facebook

LinkedIn

Digg