Vulnerabilities / Threats
8/23/2010
03:56 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says

Bug used in infamous 2007 defacement fixed, but additional SQL injection bugs remain

Three years after the United Nations' website was defaced by activist hackers using a SQL injection attack, the site still contains multiple instances of these vulnerabilities.

Security researcher Robert Graham, CEO of Errata Security, did his now-annual checkup on the UN site and found that while the UN had removed the bug that was exploited in the August 2007 attack, the site is still rife with multiple SQL injection vulnerabilities.

In the 2007 defacement, attackers replaced then-Secretary General Ban Ki-Moon's speeches with some of their own calling for "peace forever" and "no war." The attackers exploited a SQL injection bug.

"In what's become a yearly blogpost, the UN still has not fixed the SQL injection problems that led to their website being hacked back in 2007," Graham blogged today. "For example, if you click on 'print this article', then use that URL instead, the SQL injection still works."

Graham points to this example, where he shows how the Secretary-General speeches section of the site could easily be hacked by abusing the SQL injection flaws there.

Giorgio Maone, who develops the popular NoScript add-on for Firefox and a software developer working for InformAction, says the SQL injection-ridden UN website case is an example of how some organizations rely too heavily on setting rules to virtually "patch" their sites with Web application firewalls (WAFs) rather than actually fixing them. He says the bug used in the defacement was left unfixed for several months or more.

"The U.N. recurring incidents are a glaring example of this mentality: the bug which caused the original defacement I covered three years ago had gone unpatched for a long time ... instead they choose to deploy a WAF with a really naive rule, which made the vulnerability appear to be gone but was extremely easy to work around," Maone says. "Don't get me wrong: WAFs do have their utility as a first line of protection -- to understand you're under attack (via logging and smart alerts), and to take time with virtual patches while you actually fix your code for good, but they can't be taken as the alpha and the omega of your Web application security."

In addition to WAFs, organizations such as the UN should be educating developers about security best practices, and hiring out third-party assessments of the apps to audit the code and provide solutions for fixing bugs, he says.

The UN had not responded to press inquiries on the issue at the time of this posting.

Meanwhile, SQL injection can be used for much worse than defacement. Maone says planting downloadable malware on the site, installing a JavaScript sniffer on web pages to steal U.N. employees, or issuing phony statements purportedly from UN representatives are just a few examples of how the bugs could be used for more nefarious and damaging purposed against the organization.

Large organizations often do struggle to keep up with their Web security. Jeremiah Grossman, founder and CTO of WhiteHat Security, says it may be a matter of the UN not having the resources to fix its vulnerabilities, or that it has outsourced its web development and the provider isn't resolving the problems. "Fixing the [web security] issues is the famous number two thing challenging people in the security of websites," Grossman says. "It's always a resource issue: it's finding the time and money to fix them, and negotiating for developer time to do so." That can come down to choosing between taking a developer off of a revenue-generating coding project to fix a vulnerability that may or may not be exploited, for example, he says.

InformAction's Maone says the more bureaucratic organizations like the UN have even more challenges with this. "The higher you go in bureaucratized organizations, the more difficult it becomes introducing changes with the necessary agility," he says. "Really, preventing trivial SQL injections like the ones we're talking about is really easy, provided that developers are minimally trained."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web