Click to get Security Testing Quote

Plynt Blog

SQL Injection attacks sky rocketing

by Roshen Chandran  | 26 Jul 2006 | Comments

Infoworld reports a surge in SQL Injection attacks. SecureWorks, a firm that monitors databases of 1300 financial institutions, says they are seeing close to 8000 attacks/day on these databases, up from 100 to 200 attacks/day earlier this year.

The attacks apparently originate in Russia, China, Brazil, Hungary, and Korea (surprise!).

8000 attacks/day clearly suggest rampant scanning. That’s not surprising, as the simplest forms of SQL Injection can be detected using a scanner.

But we disgree with the Secure works press release that recommends the solution for these attacks:

A Network Intrusion Prevention System and Host Intrusion Prevention System can offer many of these protections, especially if they are being monitored by a 24x7x365 security team that can stay on top of the newest types of SQL Injection attacks, as there are new variances being released all the time.

It’s trivial to evade Network and Host IDS/IPS/AppFirewalls. And a SQL Injection scanner can cut through those defenses. The 24x7x365 team will not even notice the attack if it’s not a blip in the IDS radar.

The right way to block SQL Injection is to use pre-compiled SQL queries. It’s not difficult. And it works.

What’s most intriguing comes later down in the Infoworld article when it discusses an attack on Card Systems International.

The hacker used a SQL injection attack to install a program that transferred credit-card data from a database every four days to a remote computer.

Install a program using SQL Injection? Any ideas how they could have done that? Or were these two separate attacks?


Plynt provides penetration testing and code review services to clients worldwide. If you are interested, please contact us for a quote. We’ll get back to you within one working day.
Add yours.closed for this post.

1. A regular reader | 26 Jul 2006 11:12 AM

You mention it's trivial to bypass network/host ids? How can SQL Injection filters of IDS/IPS be evaded?

2. Roshen Chandran | 26 Jul 2006 11:16 AM


Two years go, Amichai Schulman of Imperva published "SQL Injection Signature Evasion" to show different methods of bypassing IDS/IPS.

http://www.imperva.com/download.asp?id=2

3. Varun | 27 Jul 2006 4:26 PM

I guess in the 2nd instance they meant just injection attack rather than an SQL injection attack.

4. Cedric | 24 Aug 2006 3:30 AM

First, it is very easy to bypass a lot of filters, even when they are implemented in the server side scripts.

Second, there is multiple ways to interact with the system running the database depending of the SQL server.

The best way to see how it works, would be to use an SQL Injection scanner like SQLiX (http://cedri.cc/tools/SQLiX_v1.0.tar.gz), and use its exploit or command injection modules.

5. Admirer | 27 Sep 2006 3:34 PM

If the SQL injection is performed over SSL enabled sites (most important sites are SSL enabled or atleast have the Login page as HTTPS) then all Network and host Intrusion detection techniques fail.

Thanks