Perimeter
8/1/2011
02:09 PM
Adrian Lane
Adrian Lane
Commentary
Connect Directly
RSS
E-Mail
50%
50%

WAFs And SQL Injection

WAFs protect databases from SQL injection for only so long

The ModSecurity site is putting on the SQL Injection Challenge. Contestants are attempting to find successful SQL injection attacks against target applications. The four sample applications are from IBM, Cenzic, HP, and Acunetix, each with a slightly different host configuration and database platform.

There are two contests within the challenge. The first test is a timed event to see who can detect the database, table, and column names behind test applications. The second test is to find a vulnerability and avoid both inbound attacks and data extrusion detection. These applications have been previously scanned for common vulnerabilities and injection attacks, and there are active Web application firewalls running.

Remember that SQL injection is an attack on a database that goes through a firewall, an application, and, in some cases, a supporting Web application firewall as well. What's also important to note here is that these "test" applications are set up to be pretty secure.

The first phase of the event has been completed, and each of the platforms were successfully compromised. On average, it took 72 hours for an attacker to break in across the various contests and against each of the four applications. The test results demonstrate that a Web application firewall (WAF) will be breached by a persistent attacker. It's not a matter of if -- it's a matter of when. The real value of WAF technology is to monitor and detect attacks so you respond to the attack. That might mean updating your WAF rules, filtering some inbound connections, double-checking that input values are properly filtered, or even taking some of your services off line.

There are a few lessons to learn here, but paramount is that you need to be monitoring activity -- and actually reviewing the logs -- if you hope to catch and react to an attack. Static defenses only last so long.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio