The SQL Injection Disconnection

A new report out this week that examines the most talked-about topics within online hacker forums shows that there may be a huge disconnect between the vulnerabilities that hackers are most keen to exploit and the risk mitigation measures CSOs squirrel away cash to purchase. Most notably, SQL injection attacks this year rose to be tied for first place with DDoS attacks as the most commonly discussed vulnerabilities by hackers.

[Want to know the scary stories that keep CSOs up on Halloween night? See. Nightmare On Database Street: 5 Database Security Horror Stories.]

Place that interest and activity next to enterprise security spending patterns and its clear a gap in perception exists, says Rob Rachwald, director of security strategy for Imperva , which released its hacker forum analysis in its October Hacker Intelligence Initiative Monthly Trend Report.

"It was really interesting to see just how differently hackers talk about security and what they do versus what security people talk about and what they do," he says.

This was the second year in a row that Imperva conducted a content analysis of a handful of smaller hacker sites alongside one of the largest-known hacker forums, which serves approximately 250,000 members. Among a sample size of 439,587 total threads between September 2011 and September 2012, SQL injection tied for first with DDoS as the number one most popular topic, with each comprising 19% of total chatter.

While the report didn't cite analyst figures to back up its estimates, Imperva said it believes that of the $25 billion spend Gartner estimated enterprises dedicated to security last year, just 5% of that goes toward SQL injection vulnerability mitigation. But what is for sure is that among those documented as the most popular security product categories--antivirus, IPS and network firewalls--none of them can detect or recognize a SQL injection, Rachwald says. In the InformationWeek Reports, the security technology voted as most effective by technologists was the firewall, rated by 66% as a top rated technology.

"We're really just trying to get people to pay attention to this problem, says Rachwald, who points to the most recent SQL injection-related South Carolina breach as evidence of where hacker interests lie.

Others around the industry agree that the South Carolina breach should provide more grist for the mill when it comes to poking at the flaws of enterprise security perceptions.

"Cases like this continue to raise awareness of the shortcomings of traditional infrastructure security in keeping sensitive data safe," said Mark Bower, data protection expert and VP at Voltage Security.

Part of the difficulty in mitigating the risks of SQL injection is the fact that at root the problem is caused by a flaw in coding practices, says Andrew Moulton, senior software development engineer at Vigilant.

"Too often we see developers quickly building SQL statements by concatenating strings," Moulton says. "Almost all database libraries support parameterized queries and can even prepare and cache them for the possibility of a little performance boost. Basically, unless you are a DBA, do not think that you are smarter than the query planner."

Moulton warns organizations that while third party input sanitization tools are a useful part of protecting existing web applications from SQL injection attacks, coders shouldn't use them as an excuse to ignore SQL injection during development.

"There is nothing wrong with using these tools; however, they are not the holy grail of protection against SQL injection attacks," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.