Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/23/2010
03:56 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says

Bug used in infamous 2007 defacement fixed, but additional SQL injection bugs remain

Three years after the United Nations' website was defaced by activist hackers using a SQL injection attack, the site still contains multiple instances of these vulnerabilities.

Security researcher Robert Graham, CEO of Errata Security, did his now-annual checkup on the UN site and found that while the UN had removed the bug that was exploited in the August 2007 attack, the site is still rife with multiple SQL injection vulnerabilities.

In the 2007 defacement, attackers replaced then-Secretary General Ban Ki-Moon's speeches with some of their own calling for "peace forever" and "no war." The attackers exploited a SQL injection bug.

"In what's become a yearly blogpost, the UN still has not fixed the SQL injection problems that led to their website being hacked back in 2007," Graham blogged today. "For example, if you click on 'print this article', then use that URL instead, the SQL injection still works."

Graham points to this example, where he shows how the Secretary-General speeches section of the site could easily be hacked by abusing the SQL injection flaws there.

Giorgio Maone, who develops the popular NoScript add-on for Firefox and a software developer working for InformAction, says the SQL injection-ridden UN website case is an example of how some organizations rely too heavily on setting rules to virtually "patch" their sites with Web application firewalls (WAFs) rather than actually fixing them. He says the bug used in the defacement was left unfixed for several months or more.

"The U.N. recurring incidents are a glaring example of this mentality: the bug which caused the original defacement I covered three years ago had gone unpatched for a long time ... instead they choose to deploy a WAF with a really naive rule, which made the vulnerability appear to be gone but was extremely easy to work around," Maone says. "Don't get me wrong: WAFs do have their utility as a first line of protection -- to understand you're under attack (via logging and smart alerts), and to take time with virtual patches while you actually fix your code for good, but they can't be taken as the alpha and the omega of your Web application security."

In addition to WAFs, organizations such as the UN should be educating developers about security best practices, and hiring out third-party assessments of the apps to audit the code and provide solutions for fixing bugs, he says.

The UN had not responded to press inquiries on the issue at the time of this posting.

Meanwhile, SQL injection can be used for much worse than defacement. Maone says planting downloadable malware on the site, installing a JavaScript sniffer on web pages to steal U.N. employees, or issuing phony statements purportedly from UN representatives are just a few examples of how the bugs could be used for more nefarious and damaging purposed against the organization.

Large organizations often do struggle to keep up with their Web security. Jeremiah Grossman, founder and CTO of WhiteHat Security, says it may be a matter of the UN not having the resources to fix its vulnerabilities, or that it has outsourced its web development and the provider isn't resolving the problems. "Fixing the [web security] issues is the famous number two thing challenging people in the security of websites," Grossman says. "It's always a resource issue: it's finding the time and money to fix them, and negotiating for developer time to do so." That can come down to choosing between taking a developer off of a revenue-generating coding project to fix a vulnerability that may or may not be exploited, for example, he says.

InformAction's Maone says the more bureaucratic organizations like the UN have even more challenges with this. "The higher you go in bureaucratized organizations, the more difficult it becomes introducing changes with the necessary agility," he says. "Really, preventing trivial SQL injections like the ones we're talking about is really easy, provided that developers are minimally trained."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17103
PUBLISHED: 2020-01-27
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
CVE-2020-8009
PUBLISHED: 2020-01-27
AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.
CVE-2019-17100
PUBLISHED: 2020-01-27
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
CVE-2019-17102
PUBLISHED: 2020-01-27
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of syst...
CVE-2017-16112
PUBLISHED: 2020-01-27
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs:CVE-2017-15010. Reason: This candidate is a reservation duplicate of CVE-2017-15010. Notes: All CVE users should reference CVE-2017-15010 instead of this candidate. All references and descriptions in this candidate have been removed to preven...