ISR News: Next-gen SQL Injection Flaws
Excerpts From The Register
A vulnerability estimated to affect more than 1 in 10 websites could go lethal with the finding that it can be used to reliably take complete control of the site’s underlying server.
Research to be presented at the Black Hat security conference in Amsterdam later this month will show how so-called SQL injection attacks open the door to much more serious exploits that give hackers unfettered access to a website’s database and the operating system that runs it. Penetration tester Bernardo Damele Assumpcao Guimaraes says his techniques prey on design flaws in three of the most popular databases, including MySQL, PostgreSQL, and Microsoft SQL Server.
SQL injections are the result of applications that fail to vet user-supplied input entered into search boxes and other website fields. Hackers can abuse this failure to access private information by entering valid commands that get executed by a website’s back-end database. Over the past five years, SQL injections have tripped up some of the world’s most sensitive sites, including the Department of Homeland Security, embassies, banks, and security companies.
“I use the SQL injection only as a stepping stone to my target, and my target is the operating system, not only the data on the database,” Damele Assumpcao Guimaraes said in an interview. “So far, a lot of research has been focused on data exfiltration and data manipulation.”
The designer of a popular security tool called SQLMap, Damele Assumpcao Guimaraes plans to offer an update during his Black Hat talk that will help penetration testers detect the new type of attacks he’s discovered.
Up to now, getting it wrong has meant running the risk that the world can rifle through databases that cough up sensitive user information or system secrets that could be used to gain access to a server. Soon, it could mean much more, not only for the tens of million of sites vulnerable to the bugs, but their visitors as well.
Filed under: Breach, D&O Liability, Financial, Government, ISR News, Uncategorized, hackers, malware, national security
Comments
One Comment on ISR News: Next-gen SQL Injection Flaws
-
ISR News: Next-gen SQL Injection Flaws | The Black Ball on
Sat, 4th Apr 2009 3:14 pm
[...] the rest here: ISR News: Next-gen SQL Injection Flaws Share and [...]
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
