Risk
10/31/2012
02:03 AM
50%
50%

The SQL Injection Disconnection

Hackers fixate on SQLi—CSOs, not so much

A new report out this week that examines the most talked-about topics within online hacker forums shows that there may be a huge disconnect between the vulnerabilities that hackers are most keen to exploit and the risk mitigation measures CSOs squirrel away cash to purchase. Most notably, SQL injection attacks this year rose to be tied for first place with DDoS attacks as the most commonly discussed vulnerabilities by hackers.

[Want to know the scary stories that keep CSOs up on Halloween night? See. Nightmare On Database Street: 5 Database Security Horror Stories.]

Place that interest and activity next to enterprise security spending patterns and its clear a gap in perception exists, says Rob Rachwald, director of security strategy for Imperva , which released its hacker forum analysis in its October Hacker Intelligence Initiative Monthly Trend Report.

"It was really interesting to see just how differently hackers talk about security and what they do versus what security people talk about and what they do," he says.

This was the second year in a row that Imperva conducted a content analysis of a handful of smaller hacker sites alongside one of the largest-known hacker forums, which serves approximately 250,000 members. Among a sample size of 439,587 total threads between September 2011 and September 2012, SQL injection tied for first with DDoS as the number one most popular topic, with each comprising 19% of total chatter.

While the report didn't cite analyst figures to back up its estimates, Imperva said it believes that of the $25 billion spend Gartner estimated enterprises dedicated to security last year, just 5% of that goes toward SQL injection vulnerability mitigation. But what is for sure is that among those documented as the most popular security product categories--antivirus, IPS and network firewalls--none of them can detect or recognize a SQL injection, Rachwald says. In the InformationWeek Reports, the security technology voted as most effective by technologists was the firewall, rated by 66% as a top rated technology.

"We're really just trying to get people to pay attention to this problem, says Rachwald, who points to the most recent SQL injection-related South Carolina breach as evidence of where hacker interests lie.

Others around the industry agree that the South Carolina breach should provide more grist for the mill when it comes to poking at the flaws of enterprise security perceptions.

"Cases like this continue to raise awareness of the shortcomings of traditional infrastructure security in keeping sensitive data safe," said Mark Bower, data protection expert and VP at Voltage Security.

Part of the difficulty in mitigating the risks of SQL injection is the fact that at root the problem is caused by a flaw in coding practices, says Andrew Moulton, senior software development engineer at Vigilant.

"Too often we see developers quickly building SQL statements by concatenating strings," Moulton says. "Almost all database libraries support parameterized queries and can even prepare and cache them for the possibility of a little performance boost. Basically, unless you are a DBA, do not think that you are smarter than the query planner."

Moulton warns organizations that while third party input sanitization tools are a useful part of protecting existing web applications from SQL injection attacks, coders shouldn't use them as an excuse to ignore SQL injection during development.

"There is nothing wrong with using these tools; however, they are not the holy grail of protection against SQL injection attacks," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Steely
50%
50%
Steely,
User Rank: Apprentice
11/2/2012 | 8:53:11 PM
re: The SQL Injection Disconnection
As ccampbell notes, companies can be slow to change their security practices - and for a variety of reasons.

I think that the article's main point that the security response to SQLi is not matching the threat is very valid. In particular, the lack of security products to deal with SQLi is a very telling indicator.

Talking about the percentage of security spending that goes to one problem or another is, in itself, a really interesting conversation. More money doesn't always mean more security, of course. So is spending a reliable indicator of how seriously a threat is being taken?
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
11/2/2012 | 10:07:39 AM
re: The SQL Injection Disconnection
Ericka, thank you very much for this insightful article. The
SQL Injection is a constant problem, and many times I find myself wondering why
does this threat still exist? Actually, hereGs an interesting article on this
matter: http://blog.securityinnovation....
Hope you find it interesting, and keep up the good work!
ccampbell443
50%
50%
ccampbell443,
User Rank: Apprentice
10/31/2012 | 7:56:02 PM
re: The SQL Injection Disconnection
It should come as no surprise that hackers are focusing on the vulnerabilities that security analysts aren't paying as much attention too.- I think companies are to slow in changing their risk profiles.- Security in your company should be an ever-changing landscape.- It has to evolve and change at the rate the hackers are evolving and changing.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?