Stop Mass SQL Injection Attacks
A new wave of mass SQL injection attacks seen in mid-August hit over half a million websites. In light of these attacks, security researchers believe now is as good of a time as any to revisit some best practices necessary to prevent mass SQL injections and mitigate the risks associated with injection attacks. These practices are hardly revolutionary, but it is clear that they aren’t being implemented as widely as they need to be.
1. Never trust input
This should be one of the mantras of developers as they write Web application code. Developers should work to ensure that inputs are sanitized before querying the database, the security researcher says.
2. Implement filtering and monitoring tools
Filtering and monitoring tools at the Web application and database levels will help block attacks and detect attack behavior in order to mitigate risk of exposure to mass SQL injection attacks. Similarly, Web application firewalls can help organizations put certain behavior-based rule sets in place to block attacks before they do damage.
3. Craft error messages carefully
Hackers can and will use your own error messages against you to better dial in future attacks. Attackers can use such messages to learn about your database schema using techniques such as ‘blind SQL injection.’
4. Patch and harden databases
The risks associated with SQL injections are escalated when the databases tied to the Web applications under attack are weak due to poor patching and configuration. Harden the database and the operating system of the machine it is running on by disabling unnecessary services and functionality.
5. Limit database privileges
Organizations need to do a better job at managing how accounts associated with Web applications are interacting with back-end databases. Many problems arise due to DBAs giving carte blanche to these accounts in order to make developers’ lives easier. But these super accounts are very vulnerable to attack and greatly broaden the risks to databases posed by SQL injection and other Web app-based attacks.