02:03 AM

The SQL Injection Disconnection

Hackers fixate on SQLi—CSOs, not so much

A new report out this week that examines the most talked-about topics within online hacker forums shows that there may be a huge disconnect between the vulnerabilities that hackers are most keen to exploit and the risk mitigation measures CSOs squirrel away cash to purchase. Most notably, SQL injection attacks this year rose to be tied for first place with DDoS attacks as the most commonly discussed vulnerabilities by hackers.

[Want to know the scary stories that keep CSOs up on Halloween night? See. Nightmare On Database Street: 5 Database Security Horror Stories.]

Place that interest and activity next to enterprise security spending patterns and its clear a gap in perception exists, says Rob Rachwald, director of security strategy for Imperva , which released its hacker forum analysis in its October Hacker Intelligence Initiative Monthly Trend Report.

"It was really interesting to see just how differently hackers talk about security and what they do versus what security people talk about and what they do," he says.

This was the second year in a row that Imperva conducted a content analysis of a handful of smaller hacker sites alongside one of the largest-known hacker forums, which serves approximately 250,000 members. Among a sample size of 439,587 total threads between September 2011 and September 2012, SQL injection tied for first with DDoS as the number one most popular topic, with each comprising 19% of total chatter.

While the report didn't cite analyst figures to back up its estimates, Imperva said it believes that of the $25 billion spend Gartner estimated enterprises dedicated to security last year, just 5% of that goes toward SQL injection vulnerability mitigation. But what is for sure is that among those documented as the most popular security product categories--antivirus, IPS and network firewalls--none of them can detect or recognize a SQL injection, Rachwald says. In the InformationWeek Reports, the security technology voted as most effective by technologists was the firewall, rated by 66% as a top rated technology.

"We're really just trying to get people to pay attention to this problem, says Rachwald, who points to the most recent SQL injection-related South Carolina breach as evidence of where hacker interests lie.

Others around the industry agree that the South Carolina breach should provide more grist for the mill when it comes to poking at the flaws of enterprise security perceptions.

"Cases like this continue to raise awareness of the shortcomings of traditional infrastructure security in keeping sensitive data safe," said Mark Bower, data protection expert and VP at Voltage Security.

Part of the difficulty in mitigating the risks of SQL injection is the fact that at root the problem is caused by a flaw in coding practices, says Andrew Moulton, senior software development engineer at Vigilant.

"Too often we see developers quickly building SQL statements by concatenating strings," Moulton says. "Almost all database libraries support parameterized queries and can even prepare and cache them for the possibility of a little performance boost. Basically, unless you are a DBA, do not think that you are smarter than the query planner."

Moulton warns organizations that while third party input sanitization tools are a useful part of protecting existing web applications from SQL injection attacks, coders shouldn't use them as an excuse to ignore SQL injection during development.

"There is nothing wrong with using these tools; however, they are not the holy grail of protection against SQL injection attacks," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
11/2/2012 | 8:53:11 PM
re: The SQL Injection Disconnection
As ccampbell notes, companies can be slow to change their security practices - and for a variety of reasons.

I think that the article's main point that the security response to SQLi is not matching the threat is very valid. In particular, the lack of security products to deal with SQLi is a very telling indicator.

Talking about the percentage of security spending that goes to one problem or another is, in itself, a really interesting conversation. More money doesn't always mean more security, of course. So is spending a reliable indicator of how seriously a threat is being taken?
User Rank: Apprentice
11/2/2012 | 10:07:39 AM
re: The SQL Injection Disconnection
Ericka, thank you very much for this insightful article. The
SQL Injection is a constant problem, and many times I find myself wondering why
does this threat still exist? Actually, hereGs an interesting article on this
matter: http://blog.securityinnovation....
Hope you find it interesting, and keep up the good work!
User Rank: Apprentice
10/31/2012 | 7:56:02 PM
re: The SQL Injection Disconnection
It should come as no surprise that hackers are focusing on the vulnerabilities that security analysts aren't paying as much attention too.- I think companies are to slow in changing their risk profiles.- Security in your company should be an ever-changing landscape.- It has to evolve and change at the rate the hackers are evolving and changing.
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-07-07
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote attackers to cause a denial of service (application crash) by establi...

Published: 2015-07-06
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.

Published: 2015-07-06
The Hospira LifeCare PCA Infusion System before 7.0 does not validate network traffic associated with sending a (1) drug library, (2) software update, or (3) configuration change, which allows remote attackers to modify settings or medication data via packets on the (a) TELNET, (b) HTTP, (c) HTTPS, ...

Published: 2015-07-06
Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block.

Published: 2015-07-06
Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) account username, a (2) node title, or a (3) team entity title.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report