Mass SQL Injection Attack Hits 1 Million Sites

A mass-injection attack similar to the highly publicized LizaMoon attacks this past spring has infected more than 1 million ASP.NET Web pages, Armorize researchers said today. According to database security experts, the SQL injection technique used in this attack depends on the same sloppy misconfiguration of website servers and back-end databases that led to LizaMoon's infiltration.

"This is very similar to LizaMoon," says Wayne Huang, CEO of Armorize, who, with his team, first reported of an injected script dropped on ASP.NET websites that load an iFrame to initiate browser-based drive-by download exploits on visitor browsers to the site.

Initial reports by Armorize showed that 180,000 Web pages had been hit by the offending script, but Huang told Dark Reading that a Google search resulted in returns for more than 1 million Web pages containing the injected code.

According to Josh Shaul, CTO of Application Security Inc., news of this latest round of infections following the hullabaloo of LizaMoon makes this kind of failure sting even more.

"This one is really disappointing because LizaMoon infected exactly the same class of systems because of exactly the same security misconfigurations," Shaul says. "It just seems like nobody running these systems paid attention."

Shaul says that a lot of times the big problem is that organizations turn off input validation on their Web servers, allowing code to be injected and databases to be compromised.

"To have input validation turned off on their Web servers seems crazy," he says. "There is literally a script feature on ASP.NET that checks input validation, and it's on by default. These people have turned it off, and I cannot wrap my head around why they're turning it off."

Huang says the sheer number of infections caused by this mass attack, and the trail of evidence his team dug up, leads him to believe that most of the pages were put up by SMBs with very little understanding of security practices.

"After so many mass SQL injection attempts have been conducted, the fact that more than a million pages have been infected means that a lot of these websites are SMB websites," he says.

He recommends that SMBs start upgrading all of their third-party libraries or frameworks to the newest version to start combating SQL injection. Additionally, he thinks they could do a better job taking advantage of free tools to scan for vulnerable code, as well as website vulnerability-scanning services that they might be paying for yet not realizing they have available to them, including some single sign-on services.

On the enterprise side, Huang says enterprises "have no excuse" to fall victim to mass attacks like these, though noting they are not as often the victims of these attacks. Shaul says enterprises that do fall victim to these attacks due to internal security sloppiness need to be wary because these mass injections could be a way for advanced attackers to do scout work.

"It's like an Internet-wide vulnerability scan. You go out and blindly inject SQL like this into a class of Web servers like ASP.NET, and then use Google now or later to look at which sites you manage to inject your SQL into. That's now a road map to vulnerable sites," he says. "You can go back and pick which ones might have interesting, valuable data sitting on them for you to go back and steal. So there may be more to this; this may lead to a bunch of targeted attacks on folks foolish enough to be this insecure with databases that are actually storing something that's worth stealing."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.