Slashdot Log In
Half a Million Microsoft-Powered Sites Hit With SQL Injection
Posted by
ScuttleMonkey
on Mon Apr 28, 2008 05:04 PM
from the little-bobby-tables-strikes-again dept.
from the little-bobby-tables-strikes-again dept.
Titus Germanicus writes to tell us that a recent attack has compromised somewhere in the neighborhood of 500,000 pages with a SQL injection attack. The vulnerability seems to be limited to Microsoft's IIS webserver and is easily defeated by the end user with Firefox and "NoScript." "The automated attack takes advantage to the fact that Microsoft's IIS servers allow generic commands that don't require specific table-level arguments. However, the vulnerability is the result of poor data handling by the sites' creators, rather than a specific Microsoft flaw. In other words, there's no patch that's going to fix the issue, the problem is with the developers who failed follow well-established security practices for handling database input. The attack itself injects some malicious JavaScript code into every text field in your database, the Javascript then loads an external script that can compromise a user's PC." Ignoring corporate spin-doctoring, there seems to be plenty of blame to go around.
Related Stories
Submission: Huge Web hack attack infects 500,000 pages by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Microsoft's Official View of the Situation (Score:5, Insightful)
As a coder, I don't agree with that. You make a tool/language/framework for developers, you better make it idiot proof. Example: C is far from idiot proof (seg fault!) but it's fast. Stupid fast. Unfortunately for C, there are more stupid coders out there like me than genuis coders out there like
Wow, for flaim retardant reasons, take the above paragraph as my meager opinion.
Re: (Score:3, Insightful)
http://www.google.com/search?hl=en&q=site%3Asecurityfocus.com+php+sql+injection [google.com]
Re: (Score:2)
Re:Microsoft's Official View of the Situation (Score:5, Informative)
Well, to quote from the Hackademix FAQ on this issue [hackademix.net]... "Crackers put together a clever SQL procedure capable of polluting any Microsoft SQL Server database in a generic way, with no need of knowing the specific table and fields layouts. There's no Microsoft-specific vulnerability involved: SQL injections can happpen (and do happen) on LAMP and other web application stacks as well. SQL injections, and therefore these infections, are caused by poor coding practices during web site development. Nonetheless, this mass automated epidemic is due to specific features of Microsoft databases, allowing the exploit code to be generic, rather than tailored for each single web site."
Parent
Re: (Score:3, Insightful)
Microsoft SQL Server is particularly vulnerable to SQL injection in a way that most other databases aren't. The problem is multiple statement execution just by inserting semicolons.
That is incorrect.
Most mainstream databases allow you to do this. Oracle and MySQL off the top of my head that I've personally done this on.
Some db adapter libraries (like one of the real simple ones in PHP for MySQL) dont let both statements get through and/or throw an error, and/or cant handle multiple result sets.
But keep in mind, an attack like this doesnt require both statements to be run in the same batch or in the same transaction, since there's no connection between the two and no result set from
Re:Microsoft's Official View of the Situation (Score:4, Insightful)
Why? It's not their responsibility to see to it that you can't write bad code for their program any more than it's the responsibility of car manufacturers to build cars that can't crash no matter how they're driven. There's only so much MSFT can do to protect lusers against their own stupidity, and if badly trained developers write vulnerable code, it's their own damned fault. I'm no Microsoft fanboi, but even I only bash them when they deserve it.
Parent
Re: (Score:2)
Ref. "Unsafe at any speed" (R.Nader) and contrasting opinion "Safe at any speed" (L.Niven). The latter story was deliberate satire. Flying your car into a Roc can be inconvenient.
Re: (Score:3, Interesting)
I'm aware this is pretty tangential, but I found it interesting that the Corvair was eventually rated to be a pretty reasonable car by the government body that Nader's book created.
Re: (Score:3, Insightful)
Microsoft provides a platform, that platform has problems, but in this case the platform had nothing to do with what happened. This rests entirely on web developers who didn't bother to do things correctly.
Re: (Score:3, Interesting)
Security like clothing works
Re: (Score:3, Insightful)
why is it only MSFT IIS and MS SQL that's affected
Because the code they used is based on the MS-SQL particular dialect, with some MS-SQL specific conventions.
The malware authors could have trivially used INFORMATION_SCHEMA views rather than sysobjects, and this would have been a generic attack that would have worked against most mainstream db servers.
while the flaw may not be MSFT's sole fault how could 500,00 people setup a server wrong including the DHS?
This has nothing, zero, to do with server setup or configuration. This is purely and soley, only has to do with web app developers allowing uncleansed commands to be sent from a web-browser to the underlyin
Re: (Score:3, Insightful)
So stock Java protects me from things like "SELECT * FROM users WHERE Name = 'eldavojohn'; DELETE FROM orders", correct?
Wait, it doesn't. Neither does PHP or Python or Perl.
So I guess you can spin it as this somehow being Microsoft's fault, and Slashdot can post it again (and maybe again tomorrow FTW), deliberately confusing pages vs sites and using titillating article titles and editorial bylines about how corporate
Re: (Score:3, Informative)
There are plenty of ways around it, but your query will fail.
Re:Microsoft's Official View of the Situation (Score:5, Interesting)
It's much harder to prevent injection of additional parameters e.g. typing ' or '1'='1 into the text box--that's something that will be language and developer dependent. From my very brief scan of the details of this vulnerability, it looks like it would have been prevented if Microsoft had disallowed multiple statements in the driver.
This page supports my interpretation. [hackademix.net] I note, specifically:
* ASP classic, due to the poor coding standards among the average VBScripters who hardly known about prepared statements (even though they are supported)
* ADO as the DB client layer, allowing stacked queries (multiple SQL statements together in a single string), which are not supported, for instance, by JDBC or by the mysql_query() PHP API
* Microsoft SQL Server, because its Transact SQL supports a rich feature set including loops, metadata enumeration and Dynamic SQL (crucial for generalization), and because itâ(TM)s the most common ASP database back-end with such high-end features.
Parent
Re: (Score:3, Insightful)
So what you are saying is that (and quoting the article you reference) Microsoft is at fault for providing these "high end features"? Even considering that it's not necessary to write sloppy VBScript code, and that it's ridiculously easy to use ADO to put together parameterized database commands, regardless of how many resultsets they are supposed to return?
And that the lack of that feature is actual
Re: (Score:2)
And this is differnt from Microsoft offerings how?
Re: (Score:3, Funny)
Re:Microsoft's Official View of the Situation (Score:4, Insightful)
If you need access to locations of memory normally protected by a seg-fault, your operating system normally provides a means to do so.
Parent
Right, but... (Score:3, Insightful)
Dupe? (Score:5, Informative)
Posted by kdawson on Friday April 25, @11:48AM
from the scream-and-shout dept.
http://it.slashdot.org/it/08/04/25/1358234.shtml [slashdot.org]
Re:Dupe? (Score:4, Interesting)
Parent
Re: (Score:2)
I think we can let it slide once and a while.
Seems familiar (Score:2)
Shameless Hibernate Plug (Score:5, Informative)
I use Hibernate [hibernate.org]. I use it with Java, although I know it's now available for
A feature of Hibernate (aside from some efficient connection pooling and resource management like caching) is that you have to actually call a delete method to delete a row. Something like HibernateSession.delete(myObject); would have to be done. And while this might sound annoying or ruin some tools that are used to generate SQL statements, it protects me time and time again. Now, you can use HQL which is a bastardized version of SQL to generate similar things but, again, I think that you can't drop/delete in it (could be wrong, rarely use it).
Try passing part of an SQL string into an object property and then merge/save it into the HibernateSession. Doesn't do the SQL injection stuff the bad guys want it to. Of course, I still use regular expression common utilities to validate the input, but assuming you didn't do that
So why don't other people use Hibernate? Am I missing something about it that's bad?
Re:Shameless Hibernate Plug (Score:4, Insightful)
Some of these complexity and efficiency issues can be resolved by partial denormalization of the database design, but again, that introduces inefficiency.
Basically, the use of a high-level framework like that introduces significantly more difficulty into the already difficult problem of performance optimization. And for most people, performance is a more immediate and obvious problem that needs solving as opposed to security.
Another problem in my opinion is that there approximately a million and one different database abstraction layers like Hibernate out there. The lack of standardization makes it very difficult for any of them to gain any sort of critical mass of developers and documentation the way SQL has.
Parent
Re: (Score:2)
Re:Shameless ORM Bashing (Score:2)
Re: (Score:2)
Seriously, the fact that in 2008 any site created by a "professional" web developer is vulnerable to SQL injection is little short of sickening.
Re: (Score:3, Insightful)
Sorry, but that's the reality; anybody on Slashdot already knows what you're saying, and the type of people who code these bugs don't read Slashdot.
Re: (Score:2)
ORM is just another way to work with database. It doesn't magically transform relative database into object database.
Dupe Dance (Score:3, Informative)
What I don't get, though, is not only does this dupe the earlier story, it dupes ALL OF THE ERRORS as well. Sheesh!
Had a problem once.. (Score:2)
I solved it quite nicely by translating any opening bracket to "ampersand-gt-;" (you know what I mean) and any urls were totally ignored after that.
It's a well known bug in IIS. (Score:2)
You can spot if pretty easily if you reload a backup from 4/25 and your web page keeps spamming out the same offensive links.
How does Apache avoid this? (Score:2)
Re: (Score:2)
So when someone appends a string to a query directly from a CGI variable (in an URL, after a questionmark - those are CGI vars
mysql_query('SELECT * FROM mytable WHERE foo = " . $_REQUEST['foo']);
What's hap
Re: (Score:3, Informative)
http://hackademix.net/2008/04/26/mass-attack-faq/#comment-7742 [hackademix.net] has a decent explanation of why this is primarily hitting IIS. SQL injection is common to many platforms, but Microsoft's database driver has some features that made it particularly easy to generalize the exploit. Specifically, prior knowledge of the table layout was apparently unnecessary to create the exploit, meaning that it was easy to hit a large number of websites in a short period of time.
Re: (Score:2)
Re: (Score:2)
Besides, there must be bugs elsewhere,
Re: (Score:2)
So it may be partially C# or just that Microsoft web devs are inherently 'dumber'.
Re: (Score:2)
Please scan your news sites for past and future php scripts if it makes you feel any better.
Coldfusion Anyone? (Score:2)
I have some experience with coldfusion and it is my opinion that a SQL injection vulnerability is pretty diffi
Re: (Score:2, Informative)
Re: (Score:2)
I have some experience with coldfusion
coldfusion is dead or dying. You are the first person that I have heard mention it in years. If people are going to choose a proprietary solution for their web application server needs then they generally choose IIS with ASP.NET; otherwise the choice is probably PHP on Apache or Ruby on Rails.
So maybe everyone should switch to a safer language, eh?
The problem here is not the language it is the use of that language in ways that are specifically warned against as being dangerous. The power to create complex applications brings with it the possibility of self-des
Re: (Score:2)
Quicky Question (Score:2)
The attack itself injects some malicious JavaScript code into every text field in your database, the Javascript then loads an external script that can compromise a user's PC
the infection requires that a local user on that database box browses the net, and hits a malicious site?
I really wonder, if users on database-running PC are supposed to browse the net, for pr0n, or what?
Am I correct that my fictitious boxen are free from danger, if I have n
Re: (Score:3, Informative)
little-bobby-tables-strikes-again dept (Score:2, Funny)
This is NOT an IIS problem (Score:3, Informative)
The query being used is exploiting features in Microsoft SQL Server, combined with a couple of external factors. Developers who have failed to check and sanitize user input, and DBAs who have not properly secured their databases. In order for your website to be owned through this attack:
- You must be running Microsoft SQL Server as your database platform
- Your web application must be vulnerable to SQL injection
- The SQL Server user that your web application authenticates as must have SELECT and UPDATE access to the sysobjects table
Notice that nowhere in that list is IIS mentioned. In addition, plenty of shops meet the first criterion above, without meeting either of the other two. Unfortunately it's all too common that web applications are configured to use the "sa" account, or some functionally-equivalent clone thereof.If your web application can query dbo.sysobjects and get anything other than "Server: Msg 229, Level 14, State 5, Line 1" in response, it's time to hire an additional DBA. If your web application allows random queries to be passed into SQL Server in the first place, it's time to hire an additional developer. In either case, make "security" a bullet-point on the job posting.
This is typical for a dupe (Score:3, Informative)
The extreme cases are actually measured in the years or hours. There's multiple cases of an article being duped 2-3 years later, especially when they're industry studies on how people use technology or occasionally about scientific discoveries. For the latter, it's often that a university announces they've done something and then publishes the results, which results in two
Re: (Score:2)