SQL injection attack in 'third wave,' says IBM

SQL injections are among the most common Web attacks, but third wave more resistant to traditional security measures

A SQL injection attack that has affected at least a half-million Web sites has entered a "third wave" that's more resistant than previous versions to traditional security measures, according to IBM security researchers.

"I've been tracking SQL injections for the last five or six years. This is some of the most intricate obfuscation I've ever seen," says David Dewey, research manager for the X-Force technology at IBM's Internet Security Systems division.

A SQL injection is an attack against a database-driven Web site in which the hacker executes unauthorized SQL commands by taking advantage of insecure code on systems connected to the Internet.

When Dewey talks about obfuscation, he's referring to hackers hiding attacks behind seemingly valid functionality. The attacks evolve as hackers change the SQL commands used to accomplish their goals, but the result is the same.

SQL injections are among the most common Web attacks, partly because a hacker needs little beyond a Web browser and knowledge of SQL queries. These most recent attacks, however, are "extremely complex" and hard to detect until it's too late, Dewey says.

Hackers are randomly targeting IP addresses throughout the world, looking for any Web site that would accept such an injection, Dewey says. Many successful, widely trusted retail Web sites are being affected. Internet surfers who navigate to infected sites are redirected to "exploitation sites" that simply look broken, with error messages and missing content. The users then are attacked with malware and added to a growing botnet, he says.

It happens so fast there's no way to avoid it. "It's the speed of light," Dewey says. The SQL injections began on a small scale in January, he says. In April, hackers modified their commands to evade security measures, and the number of attacks went "through the roof," he adds.

Less than two weeks ago, IBM researchers found the latest version, which Dewey calls the third wave. While the new version of the attack is designed to sidestep security measures put in place for the second wave, once a Web site has been hit it's pretty obvious. "This thing does not try to be sneaky," he says. "It basically tries to obliterate all of your database records and inject its own content into all of your database records." Back-end data is destroyed, whether it be customer accounts, or something simple, like the content of a blog.

Autoweb, a UK-based advertising and marketing site victimized by a recent SQL injection, recovered only after a series of countermeasures, from blocking the Chinese IP addresses where the attacks originated, to finding a developer capable of fixing a vulnerability in its Web application.

The X-Force team at IBM recently made some changes in how it detects SQL injections, changes that allowed its technology to find the latest attacks, Dewey says. Numerous other vendors are releasing updates every week to combat the problem, he notes. "With our protection, they haven't ever evaded us," he says, "so far as we know."

Recommended

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jon Brodkin

Network World

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?