Fergie's Tech Blog

SQL Injection Attack In 'Third Wave'

Jon Brodkin writes on NetworkWorld:

A SQL injection attack that has affected at least a half-million Web sites has entered a "third wave" that's more resistant than previous versions to traditional security measures, according to IBM security researchers.

"I've been tracking SQL injections for the last five or six years. This is some of the most intricate obfuscation I've ever seen," says David Dewey, research manager for the X-Force technology at IBM's Internet Security Systems division.

A SQL injection is an attack against a database-driven Web site in which the hacker executes unauthorized SQL commands by taking advantage of insecure code on systems connected to the Internet.

When Dewey talks about obfuscation, he's referring to hackers hiding attacks behind seemingly valid functionality. The attacks evolve as hackers change the SQL commands used to accomplish their goals, but the result is the same.

More here.

Note: Nothing against Mr. Dewey -- and in fact, he is right -- but I don't need IBM to tell me this -- we've been following these attacks and documenting them over on the Trend Micro Blog. -ferg

posted by Fergie @ 5/15/2008 07:24:00 PM