Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security //

Database Security

05:28 PM

Mass SQL Injection Attack Hits 1 Million Sites

Attack similar to LizaMoon hits websites lacking input validation

A mass-injection attack similar to the highly publicized LizaMoon attacks this past spring has infected more than 1 million ASP.NET Web pages, Armorize researchers said today. According to database security experts, the SQL injection technique used in this attack depends on the same sloppy misconfiguration of website servers and back-end databases that led to LizaMoon's infiltration.

"This is very similar to LizaMoon," says Wayne Huang, CEO of Armorize, who, with his team, first reported of an injected script dropped on ASP.NET websites that load an iFrame to initiate browser-based drive-by download exploits on visitor browsers to the site.

Initial reports by Armorize showed that 180,000 Web pages had been hit by the offending script, but Huang told Dark Reading that a Google search resulted in returns for more than 1 million Web pages containing the injected code.

According to Josh Shaul, CTO of Application Security Inc., news of this latest round of infections following the hullabaloo of LizaMoon makes this kind of failure sting even more.

"This one is really disappointing because LizaMoon infected exactly the same class of systems because of exactly the same security misconfigurations," Shaul says. "It just seems like nobody running these systems paid attention."

Shaul says that a lot of times the big problem is that organizations turn off input validation on their Web servers, allowing code to be injected and databases to be compromised.

"To have input validation turned off on their Web servers seems crazy," he says. "There is literally a script feature on ASP.NET that checks input validation, and it's on by default. These people have turned it off, and I cannot wrap my head around why they're turning it off."

Huang says the sheer number of infections caused by this mass attack, and the trail of evidence his team dug up, leads him to believe that most of the pages were put up by SMBs with very little understanding of security practices.

"After so many mass SQL injection attempts have been conducted, the fact that more than a million pages have been infected means that a lot of these websites are SMB websites," he says.

He recommends that SMBs start upgrading all of their third-party libraries or frameworks to the newest version to start combating SQL injection. Additionally, he thinks they could do a better job taking advantage of free tools to scan for vulnerable code, as well as website vulnerability-scanning services that they might be paying for yet not realizing they have available to them, including some single sign-on services.

On the enterprise side, Huang says enterprises "have no excuse" to fall victim to mass attacks like these, though noting they are not as often the victims of these attacks. Shaul says enterprises that do fall victim to these attacks due to internal security sloppiness need to be wary because these mass injections could be a way for advanced attackers to do scout work.

"It's like an Internet-wide vulnerability scan. You go out and blindly inject SQL like this into a class of Web servers like ASP.NET, and then use Google now or later to look at which sites you manage to inject your SQL into. That's now a road map to vulnerable sites," he says. "You can go back and pick which ones might have interesting, valuable data sitting on them for you to go back and steal. So there may be more to this; this may lead to a bunch of targeted attacks on folks foolish enough to be this insecure with databases that are actually storing something that's worth stealing."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...
PUBLISHED: 2019-10-18
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entere...