The Channel logo

News

By | Dan Goodin 26th June 2008 23:05

Microsoft and HP tackle SQL-injection scourge

A modest proposal

With successful attacks against websites reaching epidemic levels, Microsoft and HP have released a free set of tools that help developers check their web applications for the mistakes that leave them open to exploits that can steal sensitive information and harm visitors.

The tools are designed to scan websites for vulnerabilities to so-called SQL injection attacks. Over the past six months, millions of web pages, some belonging to Fortune 500 companies or government agencies, have fallen prey to the attacks. As a result, unsuspecting visitors are directed to websites that silently try to install key loggers and other types of malware.

SQL injection attacks have proved hard to stop because they aren't perpetrated on any specific software platform. Rather, they target shoddy coding practices that fail to scrutinize user-supplied input for malicious code before passing it to web applications. ASP, PHP and CGI have all been known to be affected.

The tools come as ScanSafe, a company that monitors websites for malicious behavior, reports a new wave of SQL-injection attacks that harnesses infected PCs to search out and attack vulnerable websites. Sites that are compromised, in turn, install backdoors on visitors' machines, creating a worm-like characteristic.

The so-called Asprox attacks are distinct from a recent swarm of SQL attacks that over the past few months have hit the public information site for the Phoenix Mars Lander, the Wal-Mark, the Department of Homeland Security and the UK's Civil Service. The entry of Asprox suggests other malware gangs may be adopting the technique after seeing the success of their competitors.

That's where the new tools come in. Developers can use them to check their web apps for some of the most common mistakes. One tool is called Scrawlr and is a slimmed down version of an HP tool known as WebInspect. It scans websites for SQL-injection vulnerabilities by mimicking some of the most common attack methods.

A second is known as URLScan version 3.0 Beta, which blocks certain types of HTTP requests from being processed by Microsoft's Internet Information Services (IIS). That helps prevent potentially harmful requests from reaching the Web application that are downstream.

The third tool is a source code analyzer that detects ASP code that's susceptible to SQL-injection attacks.

Not everyone traveling in security circles has taken a liking to the new release. Mike Tracy, writing on the Matasano Chargen blog, questions whether two of the apps would be better dubbed "Half-Baked Code Analyzer" or "Web Application Firewall Lite" - the implication being they are too limited to be of any real benefit.

There's no doubt that these tools are no substitute for a more in-depth security posture that every website ought to have. But what the critics seem to be missing is that given the literally millions of pages that already have been marred, SQL injections could become the web equivalent of the bubonic plague. It's time for all of us to roll up our sleeves and do what we can. Microsoft and HP's release is a good start. ®

This story was updated to correct the name of the HP product from whence Scrawlr came. The commercial HP product is known as WebInspect.

comment icon Read 37 comments on this article alert Send corrections

Opinion

Neil McAllister

Claims that cloud will drive Oracle's future growth ring hollow
Pure Storage array

Neil McAllister

How the cloud taught Redmond to play by a new set of rules

Features

Pebble Steel
Meet the man who accidentally created the smartwatch hype
No, silly... he was the fall guy for years of Finnish folly
Fraud image