Vulnerabilities / Threats
8/23/2010
03:56 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says

Bug used in infamous 2007 defacement fixed, but additional SQL injection bugs remain

Three years after the United Nations' website was defaced by activist hackers using a SQL injection attack, the site still contains multiple instances of these vulnerabilities.

Security researcher Robert Graham, CEO of Errata Security, did his now-annual checkup on the UN site and found that while the UN had removed the bug that was exploited in the August 2007 attack, the site is still rife with multiple SQL injection vulnerabilities.

In the 2007 defacement, attackers replaced then-Secretary General Ban Ki-Moon's speeches with some of their own calling for "peace forever" and "no war." The attackers exploited a SQL injection bug.

"In what's become a yearly blogpost, the UN still has not fixed the SQL injection problems that led to their website being hacked back in 2007," Graham blogged today. "For example, if you click on 'print this article', then use that URL instead, the SQL injection still works."

Graham points to this example, where he shows how the Secretary-General speeches section of the site could easily be hacked by abusing the SQL injection flaws there.

Giorgio Maone, who develops the popular NoScript add-on for Firefox and a software developer working for InformAction, says the SQL injection-ridden UN website case is an example of how some organizations rely too heavily on setting rules to virtually "patch" their sites with Web application firewalls (WAFs) rather than actually fixing them. He says the bug used in the defacement was left unfixed for several months or more.

"The U.N. recurring incidents are a glaring example of this mentality: the bug which caused the original defacement I covered three years ago had gone unpatched for a long time ... instead they choose to deploy a WAF with a really naive rule, which made the vulnerability appear to be gone but was extremely easy to work around," Maone says. "Don't get me wrong: WAFs do have their utility as a first line of protection -- to understand you're under attack (via logging and smart alerts), and to take time with virtual patches while you actually fix your code for good, but they can't be taken as the alpha and the omega of your Web application security."

In addition to WAFs, organizations such as the UN should be educating developers about security best practices, and hiring out third-party assessments of the apps to audit the code and provide solutions for fixing bugs, he says.

The UN had not responded to press inquiries on the issue at the time of this posting.

Meanwhile, SQL injection can be used for much worse than defacement. Maone says planting downloadable malware on the site, installing a JavaScript sniffer on web pages to steal U.N. employees, or issuing phony statements purportedly from UN representatives are just a few examples of how the bugs could be used for more nefarious and damaging purposed against the organization.

Large organizations often do struggle to keep up with their Web security. Jeremiah Grossman, founder and CTO of WhiteHat Security, says it may be a matter of the UN not having the resources to fix its vulnerabilities, or that it has outsourced its web development and the provider isn't resolving the problems. "Fixing the [web security] issues is the famous number two thing challenging people in the security of websites," Grossman says. "It's always a resource issue: it's finding the time and money to fix them, and negotiating for developer time to do so." That can come down to choosing between taking a developer off of a revenue-generating coding project to fix a vulnerability that may or may not be exploited, for example, he says.

InformAction's Maone says the more bureaucratic organizations like the UN have even more challenges with this. "The higher you go in bureaucratized organizations, the more difficult it becomes introducing changes with the necessary agility," he says. "Really, preventing trivial SQL injections like the ones we're talking about is really easy, provided that developers are minimally trained."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-0460
Published: 2014-04-16
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.

CVE-2011-0993
Published: 2014-04-16
SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

CVE-2011-3180
Published: 2014-04-16
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.

CVE-2011-4089
Published: 2014-04-16
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.

CVE-2011-4192
Published: 2014-04-16
kiwi before 4.85.1, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands as demonstrated by "double quotes in kiwi_oemtitle of .profile."

Best of the Web