How to deal with SQL Injection Attacks - August 17, 2008
Orlando Florida -- It’s not like SQL injection attacks are new. They go back to at least late 2004, when they appeared in Europe and Asia. A German TV station was attacked, then a Taiwanese security magazine. In 2006, Russian hackers broker into a Rhode Island government website and stole credit card data.
The attacks were proliferating. In 2007, a hacker defaced the Microsoft UK web site. Later on that year, the UN website was defaced with a SQL injunction attack. Have they no shame?
In January 2008, tens of thousands of PC websites were defaced by automated SQL injection attacks that exploited the vulnerability of Microsoft SQL server.
In April 2008, the social security numbers of the sex offenders on the Sexual Offender Registry of Oklahoma were stolen by an injection attack.
In May 2008, a server farm in China used automated queries to Google’s search engine to identify SQL server websites that were vulnerable.
In July 2008, the Malaysian site for Kaspersky, a Russian computer security company, was hacked using a SQL injection.
From April 2008 to the present, there have been increasing SQL injection attacks exploiting the SQL injection vulnerability of Microsoft Internet Information Services and SQL server.
HOW THE INJECTION ATTACK WORKS
These attacks don’t require the hacker to have access to the server or, for that matter, the names of database fields. The attack is on all text fields in all tables with a single hacked SQL request. The attack attaches an html string to each field that activates a malware javascript file called from a remote location. When that value is later displayed to a user of the hacked site, the script tries to gain control over the user’s system. When in fact the purchase of a a Barracuda Web Site Firewall protects Web applications and Web services from malicious attacks, and can also increase the performance and scalability of these applications. The Barracuda Web Site Firewall offers every capability needed to deliver, secure and manage enterprise Web applications from a single appliance through an intuitive, real-time user interface.
The number of exploited web pages is estimated at 500,000 so far, and growing daily. These attacks are across the board, against government sites and well as commercial sites, and against open source SQL as well as Microsoft SQL. The attacking mechanisms can be manual or by automated spiders or by modified versions of popular software such as QuickTime and RealPlayer.
SQL is a rich and complex language, so there are many techniques by which the attack can be accomplished. The common approach is for the hacker to modify a variable being passed from the user’s browser URL address line or from a form on the browser to a SQL search string which is being processed on the website.
With this approach, hackers or their automated spiders can inject draconian instructions into the SQL commands written for the site, and these can do any number of awful things, like stealing all the data from the SQL database, destroying the database altogether or modifying the records by adding references to remote malware that spreads the attack through innocent visitors using the site, in a kind of Trojan horse virus.
HOW DO YOU KNOW YOU’VE BEEN HIT
Don’t think you’re somehow exempt. If you’re using SQL in any form you’re vulnerable. Most websites are data driven these days, and most of those use SQL in one form or another. The hackers and their spiders may very well visit an attack on your site any time.
It goes without saying you need to back up your SQL database, all of it, every day and keep those backups for perhaps a longer period of time than before. If you have 10 days of backup but you don’t watch your site and 10 days go by, you won’t have a useable backup and you’ll be SOL.
How do you know you’ve been attacked? "Well, the data on your screen is truncated and you get strange characters like hanging apostrophes and angle brackets on your screen where database information ought to be. Sometimes you get wise guy jokes there too. Don’t click on what appear to be links - that’ll get you in more trouble and infect your machine too", says Brian McCarthy President of a Security VAR in Central Florida Sencilo Solutions.
HOW TO DEAL WITH THEM
If you’ve been attacked, you need to go to Internet Information Services (IIS) on your server and cut user connections, and stop the site. Then you need to find a good backup file to restore your database. For that, you need to figure out when the attack happened so you can use a backup from before it happened. "If you don’t have a good backup, you’ll probably have to clean the database manually to recover the data for your site," says McCarthy.
That means stripping out all the bad values and references that were injected. You have to painstakingly go through every field, record and table. In a big database, this can take forever, and it’s tedious and gut-wrenching work. Worse, it may not be a complete solution. The injection values are usually injected at the end of the existing values in the field, but if the injection values are longer than the field, they may write over the existing values, and that means the original data is lost.
When you’re done, you would turn IIS back on and see if you’ve done a good job, and whether there is some other gift they left for you. You don’t know until you bring the site up again and watch it work.
There are some scripts out there that say they can reverse the attack and clean the injected values out of your database. Here’s an example:
http://hackademix.net/2008/04/26/mass-attack-faq/#webdev
Different hackers inject different values, so there’s no guarantee that this will work.
Even assuming you can restore your database, you could have another attack any time with similar result. So if you have a good backup file of your database, make a protected copy of it for future use if necessary.
CLOSING THE VULNERABILITIES
Beyond that, you or your web designers need to close the vulnerabilities. You can do that in a variety of ways, all of which involve new coding. Go slowly and carefully, file by file, so you do it right and don’t miss anything.
When you recode, you need to write routines to clean all the parameters that are being fed into your SQL queries. To do this, you need to strip out any questionable SQL commands that could be part of an injection attack, including DECLARE, SELECT, SET, CAST, DROP, EXEC,”;”, “–”, INSERT, DELETE, XP_, VARCHAR and CHAR, among others.
WILL WE EVER CATCH THESE GUYS
Maybe not be in the meant time the Barracuda Web Site Firewall is a complete and powerful security solution for Web applications and Web sites. The Barracuda Web Site Firewall provides award-winning protection against hackers leveraging protocol or application vulnerabilities to instigate data theft, denial of service or defacement of your Web site.
For more information please call (407) 265-6293 or visit us at: http://www.sencilo.com/products-security.php
Sencilo Solutions is a Florida-based integrator specializing in network storage and information security solutions. Sencilo delivers a comprehensive portfolio of products from best-of-breed hardware and software from multiple manufacturers including VMware, EMC, RSA, Juniper Networks, Hitachi, Symantec, Barracuda Networks, and HP. Its technical expertise is known throughout the storage and security industry. Clients include leading corporations, major financial institutions, top universities, government facilities, as well as small to medium size businesses. Sencilo's professional services include consulting, integration, project management, installation, maintenance and knowledge transfer.
Sencilo has offices throughout Florida including: Jacksonville, Daytona Beach, St. Petersburg, Orlando, Hialeah, St. Augustine, Gainesville, Ocala, Palm Coast, Kissimmee, Lakeland, Maitland, Cape Canaveral, Lake Mary
Other products include Barracuda Networks Security RSA Encryption Cisco Decru Neoscale EMC NetApp Compliance vs. Gartner Magic Quadrant SSL SonicWall Secure Computing Firewall VPN Endpoint DLP Tumbleweed Ironmail Ironport Secure Computing compare data leakage enVision Data Loss Prevention Encryption and Key Management CA Symantec Juniper Symantec Norton SPAM
