Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/13/2019
08:00 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

SQL Injection Attacks Represent Two-Third of All Web App Attacks

When Local File Inclusion attacks are counted, nearly nine in 10 attacks are related to input validation failures, Akamai report shows.

Cyberattackers have several vectors for breaking into Web applications, but SQL injection continues to be by far their most popular choice, a new analysis of attack data shows.

For its "State of the Internet" report, Akamai analyzed data gathered from users of its Web application firewall technology between November 2017 and March 2019. The exercise shows that SQL injection (SQLi) now represents nearly two-thirds (65.1%) of all Web application attacks. That's up sharply from the 44% of Web application layer attacks that SQLi represented just two years ago.

Local File Inclusion (LFI) attacks, which, like SQLi, are also enabled by a Web application's failure to properly validate user input, accounted for another 24.7% of attacks. Together, SQLi and LFI attacks represented 89.8% of all attacks at the Web application layer over the 17-month period of Akamai's study.

"The growth of SQLi as an attack vector over the last two years should concern website owners," Akamai noted. "While every application attack vector is stable or growing, none are growing as quickly as SQLi."

SQL injection errors and cross-site scripting (XSS) errors have topped, or nearly topped, the Open Web Application Security Project's (OWASP) list of top 10 Web vulnerabilities for more than a decade. Just this week, in fact, HackerOne published a report showing XSS errors to be by far the most common security vulnerability in Web apps across organizations. Both XSS and SQLi are well understood, and many researchers have catalogued the dangers associated with them for years.

The fact that so many Web apps still have them reflects the relatively scant attention paid to security in the application development stage, says Andy Ellis, chief security officer at Akamai. "It is not that the developers are making errors," he says. "It is system that we put them into that is dangerous."

Developers are under pressure to deliver code and are not given clear security guidelines and libraries to work with. "How many people really understand how to write an application that can talk securely with the database in the backend?" he notes. Few developers can understand security so deeply that a security flaw would actually represent a mistake for them, Ellis says.

Akamai's data shows most Web application attacks originate from inside the US and most targets are US-based as well. Of the nearly 4 billion application-layer attacks that Akamai counted over the 17-month period, some 2.7 billion targeted US organizations. Companies in the UK, Germany, Brazil, and India were also relatively heavily targeted. though nowhere nearly as much as US companies.

Another major takeaway from Akamai's "State of the Internet" report is the sharp uptick in credential-stuffing attacks, where attackers use large datasets of stolen credentials to try and break into corporate accounts. During its analysis, Akamai counted a staggering 55 billion credential-stuffing attacks targeted at organizations in various verticals. In many cases, Akamai found attackers were launching credential-stuffing attacks using credentials that were stolen from websites via SQL injection attacks.

By far, companies in the gaming industry were the most targeted entities in credential stuffing attacks. Some 12 billion of the attacks that Akamai detected were, in fact, directed against organizations in the gaming sector. Each attack that Akamai counted represented an attempt to access an account to which the threat actor did not have legitimate access.

A lot of the interest in gaming companies appears to be the result of attackers viewing gamers as financially viable targets known for spending money on game-related items, including skins, game currency, and updates. Steve Ragan, a threat researcher from Akamai, says one of the more gratifying takeaways from the report is the fact that many gaming companies have taken measures to address the threats by educating users on issues like phishing and two-factor authentication.

"The takeaway is that credential stuffing is not going away," Ragan says. But implementing multifactor authentication can slow it down. "If you do just token multifactor authentication or SMS authentication, it is better than having nothing at all," he says. "Just user names and passwords are not really going to protect you anymore."

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SchemaCzar
50%
50%
SchemaCzar,
User Rank: Strategist
6/14/2019 | 12:31:46 PM
Quality and security of software development have degradedwhen do we call it a crisis?
We have known how to stop injection attacks for fifteen years.  However, sloppy software development and persistent use of shoddy tools like PHP, MySQL, and MongoDB are handing over control of sites and enterprises. 
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16349
PUBLISHED: 2019-09-16
Bento4 1.5.1-628 has a NULL pointer dereference in AP4_ByteStream::ReadUI32 in Core/Ap4ByteStream.cpp when called from the AP4_TrunAtom class.
CVE-2019-16350
PUBLISHED: 2019-09-16
ffjpeg before 2019-08-18 has a NULL pointer dereference in idct2d8x8() at dct.c.
CVE-2019-16351
PUBLISHED: 2019-09-16
ffjpeg before 2019-08-18 has a NULL pointer dereference in huffman_decode_step() at huffman.c.
CVE-2019-16352
PUBLISHED: 2019-09-16
ffjpeg before 2019-08-21 has a heap-based buffer overflow in jfif_load() at jfif.c.
CVE-2016-10967
PUBLISHED: 2019-09-16
The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.