Half a Million Microsoft-Powered Sites Hit With SQL Injection 222
Titus Germanicus writes to tell us that a recent attack has compromised somewhere in the neighborhood of 500,000 pages with a SQL injection attack. The vulnerability seems to be limited to Microsoft's IIS webserver and is easily defeated by the end user with Firefox and "NoScript." "The automated attack takes advantage to the fact that Microsoft's IIS servers allow generic commands that don't require specific table-level arguments. However, the vulnerability is the result of poor data handling by the sites' creators, rather than a specific Microsoft flaw. In other words, there's no patch that's going to fix the issue, the problem is with the developers who failed follow well-established security practices for handling database input. The attack itself injects some malicious JavaScript code into every text field in your database, the Javascript then loads an external script that can compromise a user's PC." Ignoring corporate spin-doctoring, there seems to be plenty of blame to go around.
Microsoft's Official View of the Situation (Score:5, Insightful)
As a coder, I don't agree with that. You make a tool/language/framework for developers, you better make it idiot proof. Example: C is far from idiot proof (seg fault!) but it's fast. Stupid fast. Unfortunately for C, there are more stupid coders out there like me than genuis coders out there like
Wow, for flaim retardant reasons, take the above paragraph as my meager opinion.
Re: (Score:3, Insightful)
http://www.google.com/search?hl=en&q=site%3Asecurityfocus.com+php+sql+injection [google.com]
Re: (Score:2)
Re: (Score:2)
Re:Microsoft's Official View of the Situation (Score:5, Informative)
Well, to quote from the Hackademix FAQ on this issue [hackademix.net]... "Crackers put together a clever SQL procedure capable of polluting any Microsoft SQL Server database in a generic way, with no need of knowing the specific table and fields layouts. There's no Microsoft-specific vulnerability involved: SQL injections can happpen (and do happen) on LAMP and other web application stacks as well. SQL injections, and therefore these infections, are caused by poor coding practices during web site development. Nonetheless, this mass automated epidemic is due to specific features of Microsoft databases, allowing the exploit code to be generic, rather than tailored for each single web site."
Re: (Score:2)
I'm sure if Microsoft didn't have those features in their databases someone would complain about it pretty severely.
Also, why do we never see Oracle vulnerabilities making the front pages? During my pen-tests I am more likely to come across Oracle servers than SQL Sewer...
Re: (Score:2)
Re: (Score:2)
Its a Microsoft flaw in my book.
Re: (Score:2)
Only Microsoft servers are affected by this specific attack.
Nearly every language and/or platform in existence right now is capable of being hit by this type of automated attack.
Nearly every mainstream DB server allows things like INFORMATION_SCHEMA or similar metadata to be accessed in this way to generically hit all tables in a db/schema.
Every single web-based language that I've ever seen is quite capable (trivial even) to create sql-injection vulnerable pages.
MS SQL Server is particularly vulnerable (Score:2)
Catalog access isn't much of a vulnerability if an attacker cannot trivially execute SQL ad lib. with a single unchecked parameter.
Re: (Score:3, Insightful)
Microsoft SQL Server is particularly vulnerable to SQL injection in a way that most other databases aren't. The problem is multiple statement execution just by inserting semicolons.
That is incorrect.
Most mainstream databases allow you to do this. Oracle and MySQL off the top of my head that I've personally done this on.
Some db adapter libraries (like one of the real simple ones in PHP for MySQL) dont let both statements get through and/or throw an error, and/or cant handle multiple result sets.
But keep in mind, an attack like this doesnt require both statements to be run in the same batch or in the same transaction, since there's no connection between the two and no result set from
Re: (Score:2)
The last three paragraphs are mine, responding to the quoted fourth-from-last.
Re: (Score:2)
That said, I wouldn't be completely surprised if some Microsoft ADO drivers for the above databases add the same "feature" in the name of SQL Server compatibility. As for myself, I avoid Microsoft server technologie
Re:Microsoft's Official View of the Situation (Score:4, Insightful)
Why? It's not their responsibility to see to it that you can't write bad code for their program any more than it's the responsibility of car manufacturers to build cars that can't crash no matter how they're driven. There's only so much MSFT can do to protect lusers against their own stupidity, and if badly trained developers write vulnerable code, it's their own damned fault. I'm no Microsoft fanboi, but even I only bash them when they deserve it.
Re: (Score:2)
Ref. "Unsafe at any speed" (R.Nader) and contrasting opinion "Safe at any speed" (L.Niven). The latter story was deliberate satire. Flying your car into a Roc can be inconvenient.
Re: (Score:3, Interesting)
I'm aware this is pretty tangential, but I found it interesting that the Corvair was eventually rated to be a pretty reasonable car by the government body that Nader's book created.
Re: (Score:2)
Re: (Score:3, Insightful)
Microsoft provides a platform, that platform has problems, but in this case the platform had nothing to do with what happened. This rests entirely on web developers who didn't bother to do things correctly.
Re: (Score:3, Interesting)
Security like clothing works
Re: (Score:3, Insightful)
why is it only MSFT IIS and MS SQL that's affected
Because the code they used is based on the MS-SQL particular dialect, with some MS-SQL specific conventions.
The malware authors could have trivially used INFORMATION_SCHEMA views rather than sysobjects, and this would have been a generic attack that would have worked against most mainstream db servers.
while the flaw may not be MSFT's sole fault how could 500,00 people setup a server wrong including the DHS?
This has nothing, zero, to do with server setup or configuration. This is purely and soley, only has to do with web app developers allowing uncleansed commands to be sent from a web-browser to the underlyin
Microsoft is at fault here (Score:2)
Oracle is not vulnerable to this type of attack, nor is DB2, nor PostgreSQL. Some databases, like MySQL, are apparently only vulnerable when using a Microsoft ADO driver - same design mistake: support for compound statements without requiring block structure (BEGIN / END) allows trivial injection of arbitrary SQL.
Re: (Score:2)
I've personally made successful sql injection attacks (in-house pen testing, not black hatting) of this sort against a variety of other platforms that had nothing to do with Microsoft, including Oracle and MySQL.
I'm not going to go into details here as I already responded in more detail to another of your posts.
Re: (Score:2)
string employee_nbr;
sql = "SELECT * FROM EMPLOYEE WHERE EMPLOYEE_ID = " + employee_nbr;
Execute(sql);
In MS SQL you could submit "1; DELETE FROM EMPLOYEE" and it would be game over. The same thing doesn't work in Oracle. The best you might do is submit "1 OR 1 = 1" and get information you weren't supposed to have.
Re: (Score:3, Insightful)
So stock Java protects me from things like "SELECT * FROM users WHERE Name = 'eldavojohn'; DELETE FROM orders", correct?
Wait, it doesn't. Neither does PHP or Python or Perl.
So I guess you can spin it as this somehow being Microsoft's fault, and Slashdot can post it again (and maybe again tomorrow FTW), deliberately confusing pages vs sites and using titillating article titles and editorial bylines about how corporate
Re: (Score:3, Informative)
There are plenty of ways around it, but your query will fail.
Re: (Score:2)
Re:Microsoft's Official View of the Situation (Score:5, Interesting)
It's much harder to prevent injection of additional parameters e.g. typing ' or '1'='1 into the text box--that's something that will be language and developer dependent. From my very brief scan of the details of this vulnerability, it looks like it would have been prevented if Microsoft had disallowed multiple statements in the driver.
This page supports my interpretation. [hackademix.net] I note, specifically:
* ASP classic, due to the poor coding standards among the average VBScripters who hardly known about prepared statements (even though they are supported)
* ADO as the DB client layer, allowing stacked queries (multiple SQL statements together in a single string), which are not supported, for instance, by JDBC or by the mysql_query() PHP API
* Microsoft SQL Server, because its Transact SQL supports a rich feature set including loops, metadata enumeration and Dynamic SQL (crucial for generalization), and because itâ(TM)s the most common ASP database back-end with such high-end features.
Re: (Score:3, Insightful)
So what you are saying is that (and quoting the article you reference) Microsoft is at fault for providing these "high end features"? Even considering that it's not necessary to write sloppy VBScript code, and that it's ridiculously easy to use ADO to put together parameterized database commands, regardless of how many resultsets they are supposed to return?
And that the lack of that feature is actual
Re: (Score:2)
So what you are saying is that (and quoting the article you reference) Microsoft is at fault for providing these "high end features"?
No, that's not what I said. I said that Microsoft could have prevented it, not that they were at fault. There's a world of difference.
And that the lack of that feature is actually an advantage for platforms like PHP and Perl?
I think that the protection against multiple statements in the MySQL driver for PHP and Perl is an advantage, yes. Much in the same way that I would consider default-bounds checking in a language an advantage. It'd be even better if you could explicitly turn the feature off in order to use "unsafe" statements. The C API to MySQL allows this--I'm not sure if the PHP ver
Re: (Score:2)
Allowing multiple statements (and multiple active result sets) is a commonly used feature for many legitimate purposes. It's not something bad to be blocked. Nearly every major db platform provides this.
Some of the language-specific adapters to said sql servers never got around to implementing this feature, but its not blocked because its a security risk.
Re: SQL Server vulnerability (Score:2)
SQL Server on the other hand is trivially exploitable if any parameter is unchecked, due to the way statements are chained together - no block syntax required, just a semicolon and anything goes after that.
Re: (Score:2)
Like most MS security holes, the problem isn't that features are available, it's that they're turned on by default.
Re: (Score:2)
Re: (Score:2)
As others have posted, it's pretty easy to prevent multiple instruction SQL injection. That's a function of the database driver, which Microsoft controls.
Actually, if we could wipe SQL off the face of the earth then we wouldn't have SQL injection attacks. I mean, for a person to be able to escape the bounds of a variable by simple insertion of code into a text field is pretty outrageous, really.
Whoever is walking around saying that they have a good product which requires programmers to use or even have to create(!) special functions to filter every bit of input to prevent injection attacks, is lying out of their posterior. It's not a good product.
Prepare
Re: (Score:2)
The easiest is just to use prepared/parameterized queries.
I think many of us have gone through the 'everything should be stored procedures' phase, but that really only works for a niche (albeit a large one) of app development.
Re: (Score:2)
SQL Server is ridiculously vulnerable (Score:2)
The safe way to support multiple statement execution ("query stacking") is with something like the block syntax of Oracle. Given a single unchecked entry field, the SQL Server syntax is trivially exploitable do anything the attacker wants.
Re: (Score:2)
And this is differnt from Microsoft offerings how?
Re: (Score:3, Funny)
Re:Microsoft's Official View of the Situation (Score:4, Insightful)
If you need access to locations of memory normally protected by a seg-fault, your operating system normally provides a means to do so.
Right, but... (Score:3, Insightful)
Re: (Score:2)
In the former case there is quite literally no memory at that location to write to.
Dupe? (Score:5, Informative)
Posted by kdawson on Friday April 25, @11:48AM
from the scream-and-shout dept.
http://it.slashdot.org/it/08/04/25/1358234.shtml [slashdot.org]
Re:Dupe? (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I think we can let it slide once and a while.
Seems familiar (Score:2)
Shameless Hibernate Plug (Score:5, Informative)
I use Hibernate [hibernate.org]. I use it with Java, although I know it's now available for
A feature of Hibernate (aside from some efficient connection pooling and resource management like caching) is that you have to actually call a delete method to delete a row. Something like HibernateSession.delete(myObject); would have to be done. And while this might sound annoying or ruin some tools that are used to generate SQL statements, it protects me time and time again. Now, you can use HQL which is a bastardized version of SQL to generate similar things but, again, I think that you can't drop/delete in it (could be wrong, rarely use it).
Try passing part of an SQL string into an object property and then merge/save it into the HibernateSession. Doesn't do the SQL injection stuff the bad guys want it to. Of course, I still use regular expression common utilities to validate the input, but assuming you didn't do that
So why don't other people use Hibernate? Am I missing something about it that's bad?
Re:Shameless Hibernate Plug (Score:4, Insightful)
Some of these complexity and efficiency issues can be resolved by partial denormalization of the database design, but again, that introduces inefficiency.
Basically, the use of a high-level framework like that introduces significantly more difficulty into the already difficult problem of performance optimization. And for most people, performance is a more immediate and obvious problem that needs solving as opposed to security.
Another problem in my opinion is that there approximately a million and one different database abstraction layers like Hibernate out there. The lack of standardization makes it very difficult for any of them to gain any sort of critical mass of developers and documentation the way SQL has.
Re: (Score:2)
Re: (Score:2)
Some of these complexity and efficiency issues can be resolved by partial denormalization of the database design, but again, that introduces inefficiency.
Which efficiency does this reduce? Normally, from a database perspective, normalizing increases data integrity at the expense of database efficiency, doesn't it?
Database frameworks can often deal with complex databases for read operations which, in this day and age, tend to be a high percentage of the operations that a database performs. They're probably worth using for read operations, and write operations where good performance isn't a requirement. You can always fall back on raw SQL (with stringently
Re: (Score:2)
Performance also tends to be better than hand coded or generated SQL mostly because Hibernate comes loaded with all sorts of database access optimization (read caching, delayed writing, batch fetching, join queries to retrieve multiple related objects, etc) - which would either have to be explicitly implemented or at the very least integrated from multiple utility libraries when not using Hibernate.
The biggest downsides of Hibernate are:
- It
Re:Shameless ORM Bashing (Score:2)
Re: (Score:2)
Seriously, the fact that in 2008 any site created by a "professional" web developer is vulnerable to SQL injection is little short of sickening.
Re: (Score:3, Insightful)
Sorry, but that's the reality; anybody on Slashdot already knows what you're saying, and the type of people who code these bugs don't read Slashdot.
Re: (Score:2)
You are completely wrong about drop/delete in HQL. Instead of quoting references you don't have, here's the result of a quick Google search.
http://www.hibernate.org/hib_docs/reference/en/html/batch.html [hibernate.org]
Your ignorance tells me you have very simple database needs. That's the siutation in whi
Don't need Hibernate per se (Score:2)
Re: (Score:2)
We've used this in the past where we had to do some fairly extreme performance optimizations for a hideous query across many joined tables, etc etc. The different db platforms required server-specific syntax to get it to perform adequately.
In addition, Hibernate is only avaialbe on Java and
This particular story is about ASP (not asp.net) pages getting hit, fo
Re: (Score:2)
ORM is just another way to work with database. It doesn't magically transform relative database into object database.
Dupe Dance (Score:3, Informative)
What I don't get, though, is not only does this dupe the earlier story, it dupes ALL OF THE ERRORS as well. Sheesh!
Re: (Score:2)
It is not an IIS problem it is a MS SQL Server "feature" whereby you can basically create a dynamic query that will go figure out your database schema for you, and dynamically perform updates on the table. This is not possible against Oracle, MySQL, or PostgreSQL, but MS SQL allows you to create a single query that can successfully attack any MS SQL database.
U
Had a problem once.. (Score:2)
I solved it quite nicely by translating any opening bracket to "ampersand-gt-;" (you know what I mean) and any urls were totally ignored after that.
It's a well known bug in IIS. (Score:2)
You can spot if pretty easily if you reload a backup from 4/25 and your web page keeps spamming out the same offensive links.
How does Apache avoid this? (Score:2)
Re: (Score:2)
So when someone appends a string to a query directly from a CGI variable (in an URL, after a questionmark - those are CGI vars
mysql_query('SELECT * FROM mytable WHERE foo = " . $_REQUEST['foo']);
What's hap
Re: (Score:3, Informative)
http://hackademix.net/2008/04/26/mass-attack-faq/#comment-7742 [hackademix.net] has a decent explanation of why this is primarily hitting IIS. SQL injection is common to many platforms, but Microsoft's database driver has some features that made it particularly easy to generalize the exploit. Specifically, prior knowledge of the table layout was apparently unnecessary to create the exploit, meaning that it was easy to hit a large number of websites in a short period of time.
Re: (Score:2)
Re: (Score:2)
Besides, there must be bugs elsewhere,
Re: (Score:2)
So it may be partially C# or just that Microsoft web devs are inherently 'dumber'.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
JAVA on the other hand is far more prepared (no pun intended) for this.
Re: (Score:2)
Please scan your news sites for past and future php scripts if it makes you feel any better.
Re: (Score:2)
- no untainting of CGI data
- bad DB interaction practices
Now, I don't do ASP, so I'm unaware of the exact details, but in Perl (and any CGI language), it's always insane NOT to untaint your input submitted by users - even if (especially if!) you have set the values in hidden fields. Something like
my $id=0; # $id must be an integer under 100
$q->param('id') =~
and $id = $1;
And, as to the SQL injection itself, if ASP doesn't have placehol
Re: (Score:2)
And, as to the SQL injection itself, if ASP doesn't have placeholders, I would blame MicroSoft. Interpolating fields into DB statements is just asking for trouble.
Using ASP/ADO/MSSQL there are several ways to protect against this.
1. Use prepared statements (also sometimes called parameterized queries, and what you're calling placeholders).
2. Use stored procedures and pass parameters.
3. Clean the form fields before putting them into your sql statement (the php approach, and also the least safe).
Re: (Score:2)
Because the likely first step is bad guys in China scanning Google search results for web pages ending in
In this case, it's SQL Server specific SQL syntax that retrieves field layouts for the database, then inserts thia attacker's javascript string
Coldfusion Anyone? (Score:2)
I have some experience with coldfusion and it is my opinion that a SQL injection vulnerability is pretty diffi
Re: (Score:2, Informative)
Re: (Score:2)
I have some experience with coldfusion
coldfusion is dead or dying. You are the first person that I have heard mention it in years. If people are going to choose a proprietary solution for their web application server needs then they generally choose IIS with ASP.NET; otherwise the choice is probably PHP on Apache or Ruby on Rails.
So maybe everyone should switch to a safer language, eh?
The problem here is not the language it is the use of that language in ways that are specifically warned against as being dangerous. The power to create complex applications brings with it the possibility of self-des
Re: (Score:2)
LOL. I guess you're the netcraft bot. Languages don't live or die based on what a bunch of fanboys with no actual programming skill put on their resume. **everybody** claims that know C++ but very few people do. By contrast, **nobody** bothers to put coldfusion on their resume unless they actually have experience with it. In other words, the numbers for the sexy (meaning, talked about on slashdot) languages are way over inflated, and the numbers for other languages are actua
Re: (Score:2)
Re: (Score:2)
Lots of people pick free solutions. Lots of people who don't pick free solutions know about IIS and MS SQL. They stick with Microsoft because it's the brand, and it's a one-stop shop for support. There are also a lot more VBS/.Net developers than Coldfusion ones, so developers will be cheaper.
That said, there are 38,000 hits from Googl
Re: (Score:2)
Thanks for the suggestion though.
Quicky Question (Score:2)
The attack itself injects some malicious JavaScript code into every text field in your database, the Javascript then loads an external script that can compromise a user's PC
the infection requires that a local user on that database box browses the net, and hits a malicious site?
I really wonder, if users on database-running PC are supposed to browse the net, for pr0n, or what?
Am I correct that my fictitious boxen are free from danger, if I have n
Re: (Score:3, Informative)
Re: (Score:2)
From my understanding, most sites employ a generic user for the db side of the things. The tricky part has to do with escape characters.
In my simple pseudo-example, I visit a shoe company site, ABC Shoes. They have a nifty product catalog search. As a hacker, I notice that the url string to search for green shoes contains: "select product_name from products where color='green'". I can change the url string to: "select product_name from products where color='green'; truncate users; insert into users (u
little-bobby-tables-strikes-again dept (Score:2, Funny)
The only story here... (Score:2)
The million dollar question is what platform and which web server is it easier to reinstall to get the site back up.
I think Linux and BSD have the advantage.
Enjoy,
Re: (Score:2)
Is that Linux, BSD, Sun, AIX, and whatever are just as vulnerable when it comes to dumb programmers.
The million dollar question is what platform and which web server is it easier to reinstall to get the site back up.
I think Linux and BSD have the advantage.
Actually, the damage is to the database. The fix is to restore from a backup taken from before the attack, resyncronize with records sanitized for the inserted bad data, fix the vulnerable code, and bring the database and web application back up.
In related news... (Score:2)
This is NOT an IIS problem (Score:3, Informative)
The query being used is exploiting features in Microsoft SQL Server, combined with a couple of external factors. Developers who have failed to check and sanitize user input, and DBAs who have not properly secured their databases. In order for your website to be owned through this attack:
- You must be running Microsoft SQL Server as your database platform
- Your web application must be vulnerable to SQL injection
- The SQL Server user that your web application authenticates as must have SELECT and UPDATE access to the sysobjects table
Notice that nowhere in that list is IIS mentioned. In addition, plenty of shops meet the first criterion above, without meeting either of the other two. Unfortunately it's all too common that web applications are configured to use the "sa" account, or some functionally-equivalent clone thereof.If your web application can query dbo.sysobjects and get anything other than "Server: Msg 229, Level 14, State 5, Line 1" in response, it's time to hire an additional DBA. If your web application allows random queries to be passed into SQL Server in the first place, it's time to hire an additional developer. In either case, make "security" a bullet-point on the job posting.
This IS an SQL problem (in part) (Score:2)
I agree that this is not an IIS problem. IIS is just a convenient target. And it may also be the case that users of IIS are less likely to do proper data sanitation than those who can't use IIS. But I would argue that SQL is a major target of blame.
Long long ago when I first learned of SQL, it was described as a command line language which would allow people to do innovative database searches. I saw several examples of such. The lecturer was even typing them in manually. It sure looked like a really
Dynamic SQL was once an anomaly (Score:2)
Parameters were bound by name to host language variables, and the precompiler handled the mapping to the underlying database library. Much more secure than dynamic SQL without bound parameters.
Of course as computers got faster, the p
Solutions (Score:2)
Now, there are other attacks that rely on SQL injection... and the prevention is arguably worse than the disease. These days, a lot of DBAs will say that best practice in SQL Server or any sort of database is often said to be against using SQL directly, and wrapping everything in st
This is typical for a dupe (Score:3, Informative)
The extreme cases are actually measured in the years or hours. There's multiple cases of an article being duped 2-3 years later, especially when they're industry studies on how people use technology or occasionally about scientific discoveries. For the latter, it's often that a university announces they've done something and then publishes the results, which results in two
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
but unless you provide the validation tool, its still your fault - you the language designer
I'll bet 90% of the coding errors were done by developers who said "I hate those Visual Studio wizards Microsoft has for data access. I can do it better myself." Sure, the wizards aren't the best way to build an application, but at least they prevent SQL injection. I meet these people every day... they think they know a lot about programming, but really they are people with 20 years of experience just barely making applications work and developing more and more bad practices every day.
It's fine to rejec
Re: (Score:2)