Last month, Yahoo found itself so overly distracted with kicking out and hiring yet another CEO that it fell prey to an old school SQL injection attack. Security gurus reacted with scorn and dismay at Yahoo’s allowing 400,000 user names and passwords to be carried out the door then displayed on someone’s front lawn for all the world to see, like a yard sale with no buyers.
How could the company not be using a damp towel to wipe the egg from its face? It had fallen prey to a hacker trick so well documented that any online search for the phrase “prevent SQL injection” will cough up 600,000 results.
We can excuse Yahoo for not being the only household brand victim, thanks to SQL attacks on Sony, LinkedIn, even Lady Gaga and another 115 million web applications, according to data protection vendor Imperva.
In a nutshell, hackers visit a website and fill out a text field with a SQL statement such as 1+1=2, which the log-in field interprets as true, allowing it to pass as legitimate credentials. The SQL database is tricked into giving up the goods, which usually comprises credit card numbers, user names and passwords.
Although ways to patch this vulnerability are readily at hand, ways to detect an imminent attack can easily falter since it’s difficult to distinguish SQL statements from random gibberish used to inject attack code. For these reasons SQL attacks, while well understood and preventable, are not taking an early retirement any time soon.
Privacy Rights Clearinghouse reported that 312 million data records have been lost since 2005 and 83% of hacking-related data breaches were executed via SQL injection attacks.
In a period of six months, UK-based secure cloud hosting company, FireHost reported a huge 69% jump in SQL injection attacks. It tracks these numbers based on the hundreds of thousands of total attacks it blocks on behalf of its cloud hosting clients.
FireHost defines a group of four attack types it calls a “Superfecta,” as being the most nasty and dangerous. The Superfecta comprises cross-site scripting (XSS), directory traversals, SQL Injections, and cross-site request forgery (CSRF).
At the Black Hat conference last week, engineering director Nick Galbreath of Etsy, a marketplace site for small businesses making handmade goods, explained the difficulty of deciphering between benign and malignant SQL input numbers. “How do you detect if user input is SQL, good input, or what? Is that my phone number or an arithmetic expression? Is it a Twitter handle or is it a SQL variable?” The engineer spoke about a “tokenization” means to analyzing SQL injections.
Taking a lexical analysis approach called libinjection, it takes real-time user input from a website and converts that into a stream of tokens. The result (“tokenization”) is an open C library that makes the tool more lightweight and easier to analyze the user data.
“What it does is it converts input into a stream of tokens. There’s a master list of keywords and functions which is sort of combined against all the major databases. It’s not completely intractable and it handles also the comments strings, literals and all the weird cases.
“So it goes through, disambiguates, merges tokens, specializes, merges strings together, does all the stuff it needs to do and then it does one last step, which is really designed to reduce false positives,” Galbreath said. “If it sees a bunch of arithmetic operations together, it just merges them all together. My phone number just returns into 1. We don’t actually care what the value is because SQL injection doesn’t care what the value is, just that there’s a number there. Same thing with multiple nested parenthesis, it just gets rid of them.”
The beauty of this approach is that the tool does not have to sift through reams of user data to discern whether the user input is malicious or benign. After analyzing millions of input scenarios Galbreath found that the number of tokens needed to distinguish between SQL injection and benign input was just five tokens.
“That’s pretty interesting compared to regular expression, because then you’re parsing the entire input. If you have 10 megs of input, [libinjection] will be parsing 10 megs of data. Then as soon as it hits five tokens, done.”
Consider the stance from cloud hosting providers. If they can detect and block an attack against one website residing on their network, then they can collect this information over time, building knowledge that can be used to protect the entire hosted community.
“As cloud environments continue to rise, the security infrastructures are not adequately addressing the SQL injection problem,” said Chris Drake, FireHost CEO. “An alternative approach is one that incorporates rules specific to each customer. Rules that benefit from learnings across the hundreds of millions of hack attempts seen across an entire customer base hosted in the same cloud environment.”
For the most part, SQL Injection attacks are automated and website owners may be blissfully unaware that their data could actively be at risk. Sites continue to lose customer data to digital thieves.
Says Stan Stahl, president of the Los Angeles chapter of ISSA security association, “We simply cannot tolerate a head-in-the-sand attitude, whether by web developers or the people who hire and manage them. The consequences of willful ignorance are too grave.”
Go Back to Top. Skip To: Start of Article.