Download as PDF, PPTX
Uploaded byImperva
SQL Injection - The Unknown Story
This document summarizes a webinar about SQL injection attacks. It discusses how SQL injection has remained the primary method of data theft from hacking. It provides statistics on the prevalence of SQL injection vulnerabilities and attacks. It then outlines the typical process attackers use, including using Google dorks to find vulnerable sites, scanning sites for vulnerabilities, and using automated tools like Havij and SQLmap to carry out attacks. The document concludes with recommendations for organizations on how to prevent SQL injection attacks, such as deploying web application firewalls, integrating vulnerability scanners, blocking known attacker systems, and fixing vulnerabilities.
More Related Content
Similar to SQL Injection - The Unknown Story
SQL Injection - The Unknown Story
- 1. SQL Injection –The Unknown Story Rob Rachwald, Director of Security Strategy, Imperva Live Webinar - October 26, 2011
- 2. Agenda SQL Injection:A Short Primer SQL Injection Today + Attack Statistics + Attack Process + Attack Tools Mitigation Checklist
- 3. Today’s Presenter Rob Rachwald,Dir. of Security Strategy, Imperva Research + Directs security strategy + Works with the Imperva Application Defense Center Security experience + Fortify Software and Coverity + Helped secure Intel’s supply chain software + Extensive international experience in Japan, China, France, and Australia Thought leadership + Presented at RSA, InfoSec, OWASP, ISACA + Appearances on CNN, SkyNews, BBC, NY Times, and USA Today Graduated from University of California, Berkeley
- 4.
- 5. Reason for DataLoss from Hacking: 2005-2011 Other 17% SQL injection 83% Total=315,424,147 records (856 breaches) Source: Privacy Rights Clearinghouse
- 6. Total Web ApplicationVulnerabilities # of websites (estimated: July 2011)* : 357,292,065 x # of vulnerabilities** : 230 1% 821,771,600 vulnerabilities in active circulation *Source: http://news.netcraft.com/archives/2011/07/08/july-2011-web-server-survey.html **Source: https://www.whitehatsec.com/home/resource/stats.
- 7. How Many SQLInjections? 821,771,600 vulnerabilities in active circulation What About SQL Injections? 10%? 82,177,160 20%? 164,354,320 30%? 246,531,480
- 8. SQL Injection MeansBusiness, Literally
- 9.
- 10. SQL Injection: TechnicalImpact Retrieve sensitive data from the organization Steal the site’s administrator password Lead to the downloading of malware
- 11. SQL Injection: BusinessImpact Breach Date March 15, 2011 Breach Date January 19, 2009
- 12. SQL Injection Today:Attack Stats
- 13. Still a VeryRelevant Attack On average, we identified 53 SQLi attacks per hour and 1,093 attacks per day.
- 14. SQL Injections Bythe Hour
- 15. Majority of Attacksfrom Small Number of Hosts 41% of all SQLi attacks originated from just 10 hosts
- 16. SQL Injection Today:Attack Process
- 17. Hackers Increasingly BypassSimple Defenses 1'/**/aND/**/'8'='3 1 DeClARe @x varchar(99) set @x=0x77616974666f722064656 c61792027303a303a323027 exec(@x)-- concat() and char() x' wAiTfOr dELay '0:0:20'--
- 18. Getting Started Option1a: Dorking + Intent: Find something generally vulnerable Option 1b: General purpose scanner + Intent: Find something specifically vulnerable
- 19. Step 1a: GoogleDorks
- 20. Step 1a: GoogleDorks What is It? A google search term targeted at finding vulnerable websites. How Does It Work? An attacker armed with a browser and a dork can start listing potential attack targets. By using search engine results an attacker not only lists vulnerable servers but also gets a pretty accurate idea as to which resources within that server are potentially vulnerable.
- 21.
- 22.
- 23. Carrying Out Attacksvia Compromised Hosts
- 24. Dork Power: QueriesPer Hour
- 25. Dork Power: QueriesPer Day
- 26. Dorking in Action(Non SQL Example)
- 27. Dork Origins Country # of Dork Queries % of Dork Queries Islamic Republic of Iran 227,554 41 Hungary 136,445 25 Germany 80,448 15 United States 19,237 3.5 Chile 17,365 3 Thailand 16,717 3 Republic of Korea 11,872 2 France 10,906 2 Belgium 10,661 2 Brazil 7,559 1.5 Other 8,892 2
- 28. Step 1b: Scanners Choose the target site Scan it with scanner to find vulnerabilities Expand the vulnerability into full blown exploit
- 29. Step 1b: AutomatedScanning, Service
- 30. Step 1b: AutomatedScanning, Service
- 31. Step 3: AutomatedAttack Tools SQLmap Havij
- 32. Automated Tools Havij/SQLmappick up where scanner stops and exploit the application + Inserts sql statements + Will not scan full app, just specific areas. Makes a small hole really big + Fetches specific information, such as column data
- 33. SQLi Attack Vectors Direct query manipulation Discovering the database structure Union Select SQL injection Time-based blind SQL injection Bypassing simple parameter sanitation
- 34.
- 35. SQL Injection Today:Attack Tools
- 36. Main Automated AttackTools SQLmap Havij
- 37.
- 38.
- 39. Step 1: DorkYourself Put detection policies in place (using the data source monitoring solution) to depict move of sensitive data to public facing servers. Regularly schedule “clean ups”. Every once in a while, a clean-up should be scheduled in order to verify that no sensitive data resides in these publicly accessible servers. Periodically look for new data stores that hold sensitive data. Tools exist today to assist in the task of detecting database servers in the network and classifying their contents.
- 40. Step 2: Createand Deploy a Blacklist of Hosts that Initiated SQLi Attacks Positives + Blocks up to 40% of attack traffic + Easy Negatives + Does not deal with the underlying problem
- 41. Step 3: Usea WAF to Detect/Block Attacks Positives + Can block many attacks + Relatively easy + Can accelerate SDLC Negatives + Can become a crutch + Potential for false positives
- 42. Step 4: WAF+ Vulnerability Scanner “Security No-Brainer #9: Application Vulnerability Scanners Should Communicate with Application Firewalls” —Neil MacDonald, Gartner Source: http://blogs.gartner.com/neil_macdonald/2009/08/19/security-no-brainer-9-application-vulnerability- scanners-should-communicate-with-application-firewalls/
- 43. Virtual Patching throughScanner Integration Apply SecureSphere policies based on scan results Monitor attempts to exploit known vulnerabilities Fix and test vulnerabilities on your schedule Scanner finds vulnerabilities Customer Site SecureSphere imports Monitor and protect scan results Web applications
- 44. Step 5: StopAutomated Attack Tools Positives + Detects automated tool fingerprints to block many attacks + Relatively easy Negatives + Potential for false positives
- 45. Step 6: CodeFixing Positives + Root cause fixed + Earlier is cheaper Negatives + Expensive, time consuming + Never-ending process
- 46. Summary: The Anti-SQLStack Dork Yourself Blacklist WAF WAF + VA Stop Automated Attacks Code Fixing
- 47.
- 48. Our Story in60 Seconds Attack Usage Protection Audit Virtual Rights Patching Management Reputation Access Controls Control
- 49. Webinar Materials GetLinkedIn to Imperva Data Security Direct for… Answers to Post-Webinar Attendee Discussions Questions Webinar Recording ADC Research Link Report
- 50.