Analytics

5/13/2008
09:00 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Third Wave of Web Attacks Not the Last

The latest round of SQL injection Website attacks is stealthier - and from multiple regions

Researchers say the latest wave of Web hacks is related but more sophisticated -- and may have spawned copycat attacks.

David Dewey, manager of IBM ISS X-Force Research, says the latest round of SQL injection attacks on legitimate Websites are using commands that aren’t typical SQL commands. “These are commands that are intended to hide from network monitoring devices” such as IPSes and Web application firewalls, Dewey says. “The changes we're seeing are in their obfuscation techniques."

X-Force has seen anywhere from 20 to 30 new malicious sites popping up each day to host the malicious content that the attacks use, he says. The attacks for the most part have been out of China, Dewey says, but there’s been a growing trend of the attacks coming out of Europe as well.

He and his team believe the attack was initially organized by a single group, likely in China. “Then it caught on, and there were more waves,” some of which were possibly copycat attacks as well as other groups joining in, he says.

X-Force first noticed someone experimenting with this very type of attack that’s now underway back in January. So far, the infected Websites have been random victims, Dewey says. “As far as we can tell, the targets seem to be arbitrary. They blast it out and whoever accepts this SQL injection ends up being attacked.”

And although the attackers are using SQL injection to infect the Website applications, SQL injection is really just a means to setting up a persistent cross-site scripting (XSS) attack, Dewey says. “When you get down to the nuts and bolts of it, this is a cross-site scripting attack. SQL injection was just a vehicle to get there,” he says. “That’s because this is a more likely source of a persistent XSS than if the vehicle was XSS itself,” which would require a more targeted attack rather than the blanket one we’re seeing, he says.

And expect yet another wave of SQL injection attacks, he says. “There will be a fourth, a fifth, and a sixth."

“Frankly, SQL injection [vulnerabilities] have been so prolific for so long I’m surprised it took so long for it to be” exploited this way, Dewey says.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • IBM Internet Security Systems

    Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Microsoft President: Governments Must Cooperate on Cybersecurity
    Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
    Why the CISSP Remains Relevant to Cybersecurity After 28 Years
    Steven Paul Romero, SANS Instructor and Sr. SCADA Network Engineer, Chevron,  11/6/2018
    5 Reasons Why Threat Intelligence Doesn't Work
    Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    Flash Poll
    Online Malware and Threats: A Profile of Today's Security Posture
    Online Malware and Threats: A Profile of Today's Security Posture
    This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-19220
    PUBLISHED: 2018-11-12
    An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to execute arbitrary PHP code via the host parameter to the install/ URI.
    CVE-2018-19221
    PUBLISHED: 2018-11-12
    An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter.
    CVE-2018-19222
    PUBLISHED: 2018-11-12
    An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysql_hy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists.
    CVE-2018-19223
    PUBLISHED: 2018-11-12
    An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.
    CVE-2018-19224
    PUBLISHED: 2018-11-12
    An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.