Vulnerabilities / Threats
8/23/2010
03:56 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says

Bug used in infamous 2007 defacement fixed, but additional SQL injection bugs remain

Three years after the United Nations' website was defaced by activist hackers using a SQL injection attack, the site still contains multiple instances of these vulnerabilities.

Security researcher Robert Graham, CEO of Errata Security, did his now-annual checkup on the UN site and found that while the UN had removed the bug that was exploited in the August 2007 attack, the site is still rife with multiple SQL injection vulnerabilities.

In the 2007 defacement, attackers replaced then-Secretary General Ban Ki-Moon's speeches with some of their own calling for "peace forever" and "no war." The attackers exploited a SQL injection bug.

"In what's become a yearly blogpost, the UN still has not fixed the SQL injection problems that led to their website being hacked back in 2007," Graham blogged today. "For example, if you click on 'print this article', then use that URL instead, the SQL injection still works."

Graham points to this example, where he shows how the Secretary-General speeches section of the site could easily be hacked by abusing the SQL injection flaws there.

Giorgio Maone, who develops the popular NoScript add-on for Firefox and a software developer working for InformAction, says the SQL injection-ridden UN website case is an example of how some organizations rely too heavily on setting rules to virtually "patch" their sites with Web application firewalls (WAFs) rather than actually fixing them. He says the bug used in the defacement was left unfixed for several months or more.

"The U.N. recurring incidents are a glaring example of this mentality: the bug which caused the original defacement I covered three years ago had gone unpatched for a long time ... instead they choose to deploy a WAF with a really naive rule, which made the vulnerability appear to be gone but was extremely easy to work around," Maone says. "Don't get me wrong: WAFs do have their utility as a first line of protection -- to understand you're under attack (via logging and smart alerts), and to take time with virtual patches while you actually fix your code for good, but they can't be taken as the alpha and the omega of your Web application security."

In addition to WAFs, organizations such as the UN should be educating developers about security best practices, and hiring out third-party assessments of the apps to audit the code and provide solutions for fixing bugs, he says.

The UN had not responded to press inquiries on the issue at the time of this posting.

Meanwhile, SQL injection can be used for much worse than defacement. Maone says planting downloadable malware on the site, installing a JavaScript sniffer on web pages to steal U.N. employees, or issuing phony statements purportedly from UN representatives are just a few examples of how the bugs could be used for more nefarious and damaging purposed against the organization.

Large organizations often do struggle to keep up with their Web security. Jeremiah Grossman, founder and CTO of WhiteHat Security, says it may be a matter of the UN not having the resources to fix its vulnerabilities, or that it has outsourced its web development and the provider isn't resolving the problems. "Fixing the [web security] issues is the famous number two thing challenging people in the security of websites," Grossman says. "It's always a resource issue: it's finding the time and money to fix them, and negotiating for developer time to do so." That can come down to choosing between taking a developer off of a revenue-generating coding project to fix a vulnerability that may or may not be exploited, for example, he says.

InformAction's Maone says the more bureaucratic organizations like the UN have even more challenges with this. "The higher you go in bureaucratized organizations, the more difficult it becomes introducing changes with the necessary agility," he says. "Really, preventing trivial SQL injections like the ones we're talking about is really easy, provided that developers are minimally trained."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio