Data Driver

Blog archive

SQL Injections: The Attacks Continue

The SQL injection saga first outlined here last week continues in the form of new attacks, while others are talking about what developers need to do to minimize their exposure.

The Shadowserver Foundation, a volunteer watchdog consortium of security pros who track various threats, today reported that the latest SQL injection exploit is affecting the "winzipices.cn domain name." According to today's posting by Steven Adair, the attack has hit more than 4,000 pages.

Web sites that have been hacked will see the following HTML source code on the pages affected:

<script src=hxxp://winzipices.cn/5.js></script>

CNET senior editor Robert Vamosi posted an enlightening interview with Jeremiah Grossman, CTO of WhiteHat Security, who describes how these latest SQL attacks are carried out in comparison to attacks in the past. Notably, he touches on a sensitive spot with database developers and the theme of my last post: Microsoft's contention that this exploit is not a bug in SQL Server but rather it exploits a feature of the database -- and one that is not at risk if developers employ the proper practices.

Indeed, most who responded to last week's entry here agree that while the latest attack affects only SQL Server, critics should not be so quick to pounce on Microsoft.

"In this case I absolutely agree that it's not the fault of the DBMS," writes Lee from the Solomon Islands. "Since I first heard of SQL insertion attacks I developed a small set of functions to filter every input from my Web sites (or others). I can't see any excuse for not doing this once, and then simply copying the code from one project to the next."

Ralph Wilson, from Boerne, Texas, who was a developer and now is moving toward becoming a database modeler, says many developers are unaware of the impact SQL injections can have. "I can tell you from personal experience that there are a lot of developers out there who do not realize the possibilities and vulnerabilities of insertion attacks," Wilson wrote. "I know that, before encountering one, I didn't realize how easy it could be."

However, Wilson believes fault lies with managers who pressure developers to move projects along. "The Injection Attack Fault Line starts at the top of the IT chain of command, if not at the top of the organization," he says. "The management culture that tries too hard to run a 'lean, mean, coding machine' usually sets IT up so that it is about 90 percent staffed to do the 125 percent work load."

Managers and developers alike shouldn't underestimate the threat of SQL injections, writes Robert Robbins from Williamsport, Pa. "I've seen the SQL being injected in these attacks and it is really devious," writes Robbins. "It casts a lengthy series of numbers into the actual SQL command so just parsing for a few SQL keywords may not catch this. It also uses table cursors and system objects to discover the table and column names. That allows it to infect the entire database without knowing the schema. Even a Web site that protects against SQL injection may be unprepared for this particular example."

What affect has the latest spate of attacks had on your organization's development practices? If you've been hit, what are you doing about it? Drop me a line.

Posted by Jeffrey Schwartz on 05/07/2008


comments powered by Disqus

Featured

  • Cloud-Focused .NET Aspire 9.1 Released

    Along with .NET 10 Preview 1, Microsoft released.NET Aspire 9.1, the latest update to its opinionated, cloud-ready stack for building resilient, observable, and configurable cloud-native applications with .NET.

  • Microsoft Ships First .NET 10 Preview

    Microsoft shipped .NET 10 Preview 1, introducing a raft of improvements and fixes across performance, libraries, and the developer experience.

  • C# Dev Kit Previews .NET Aspire Orchestration

    Microsoft's dev team has been busy updating the C# Dev Kit, a Visual Studio Code extension that enhances the C# development experience by providing tools for managing, debugging, and editing C# projects.

  • Hands On: New VS Code Insiders Build Creates Web Page from Image in Seconds

    New Vision support with GitHub Copilot in the latest Visual Studio Code Insiders build takes a user-supplied mockup image and creates a web page from it in seconds, handling all the HTML and CSS.

  • Naive Bayes Regression Using C#

    Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the naive Bayes regression technique, where the goal is to predict a single numeric value. Compared to other machine learning regression techniques, naive Bayes regression is usually less accurate, but is simple, easy to implement and customize, works on both large and small datasets, is highly interpretable, and doesn't require tuning any hyperparameters.

Subscribe on YouTube

Upcoming Training Events