Timeline: Outbreak! - The rise of the SQL infection
IT PRO has been watching and charting the progress of what is one of the biggest and most high profile web security threats of this year - the SQL injection.
The first six months of 2008 has seen a massive increase in SQL injection attacks, which can lead to legitimate websites we know and trust being compromised and infected with malware.
An SQL injection attack occurs when an attacker exploits weaknesses in the design of a website, gaining access and taking it over. Once in control of the database they will take data and add a malicious link. This usually takes the form of a drive-by download.
It was back at the end of 2006 when IT PRO first looked at the growing threat of the SQL injection attack. The chief executive of data security company Secerno Paul Davie predicted that by 2007, the SQL injection would become the number one attack vector on internet-facing systems.
Around this time last year, there was an SQL injection attack which was more about vandalism rather than financial motivation, but nevertheless saw major potential for damage. At the time there was surprise that it affected such a high profile website, but as 2008 has seen it is now much more common for this to happen.
Last April saw one of the most serious SQL injection attacks in history, with half a million web pages affected thanks to an automated attack taking advantage of website vulnerabilities. Microsoft themselves denied responsibility for the problem, but it did show the size of the possible threat as well at the potential for harm.
Another 9,000 Western websites were compromised thanks to an attack believed to have been launched from China. The attacks took advantage of Real Player and Internet Explorer vulnerabilities to inject an iframe which loaded malicious content – in this case a password stealing Trojan.
July 2008: NHS website affected by mass SQL ‘Asprox’ attackIT PRO led with a story about an SQL injection attack caused by a Trojan toolkit called Asprox which worked by searching for Google pages which are ripe and vulnerable for an attack. Around a thousand websites were affected including many respectable and governmental organisations, included the official NHS website.
The latest Sophos report showed very little hope of a solution to the increase in SQL attacks, confirming that SQL injection is one of the most dominant malware trends of 2008. The biggest problem was that many websites were not coded properly, and this was the vulnerability that allowed trusted places to get hit. Sophos claimed that the problem would only get worse in the next six months, and warned businesses to keep a close eye in keeping their online presences clean.