Perimeter
8/1/2011
02:09 PM
Adrian Lane
Adrian Lane
Commentary
50%
50%

WAFs And SQL Injection

WAFs protect databases from SQL injection for only so long

The ModSecurity site is putting on the SQL Injection Challenge. Contestants are attempting to find successful SQL injection attacks against target applications. The four sample applications are from IBM, Cenzic, HP, and Acunetix, each with a slightly different host configuration and database platform.

There are two contests within the challenge. The first test is a timed event to see who can detect the database, table, and column names behind test applications. The second test is to find a vulnerability and avoid both inbound attacks and data extrusion detection. These applications have been previously scanned for common vulnerabilities and injection attacks, and there are active Web application firewalls running.

Remember that SQL injection is an attack on a database that goes through a firewall, an application, and, in some cases, a supporting Web application firewall as well. What's also important to note here is that these "test" applications are set up to be pretty secure.

The first phase of the event has been completed, and each of the platforms were successfully compromised. On average, it took 72 hours for an attacker to break in across the various contests and against each of the four applications. The test results demonstrate that a Web application firewall (WAF) will be breached by a persistent attacker. It's not a matter of if -- it's a matter of when. The real value of WAF technology is to monitor and detect attacks so you respond to the attack. That might mean updating your WAF rules, filtering some inbound connections, double-checking that input values are properly filtered, or even taking some of your services off line.

There are a few lessons to learn here, but paramount is that you need to be monitoring activity -- and actually reviewing the logs -- if you hope to catch and react to an attack. Static defenses only last so long.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9710
Published: 2015-05-27
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time windo...

CVE-2014-9715
Published: 2015-05-27
include/net/netfilter/nf_conntrack_extend.h in the netfilter subsystem in the Linux kernel before 3.14.5 uses an insufficiently large data type for certain extension data, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via outbound network traffic that trig...

CVE-2015-1157
Published: 2015-05-27
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2)...

CVE-2015-2666
Published: 2015-05-27
Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to t...

CVE-2015-2830
Published: 2015-05-27
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrate...

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?