Report: More Than 500,000 Websites Hit By New Form Of SQL Injection In '08

A new flavor of an old-school Web attack was responsible for compromising more than 500,000 Websites last year.

An automated form of SQL injection using botnets emerged as the popular method of hacking Websites, according to a newly released report from the Web Hacking Incidents Database (WHID), an annual report by Breach Security and overseen by the Web Application Security Consortium (WASC). The report also found that attackers increasingly are targeting a Website's customers rather than the sensitive information in the site's database.

"It used to be that mostly e-commerce sites were targeted, but now it's potentially any site, especially those with a large customer base," says Ryan Barnett, director of application security research for Breach Security. "The attackers say, 'You're going to become a malware-launching point for us.'"

The so-called Mass SQL Injection Bot attacks basically automate the infection process; the Nihaorr1 and Asprox botnets both deployed this method last year, according to the report. "In the past, they had to do some manual reconnaissance with SQL injection to send the initial queries," Barnett says. The automated approach sent one request with a script that automated all of those recon steps -- using bots to perform the attacks.

"While the initial attack vector was SQL Injection, the overall attack more closely resembles a Cross-Site Scripting methodology as the end goal of the attack was to have malicious JavaScript execute within victims' browsers," the WHID reports says. "The JavaScript calls up remote malicious code that attempts to exploit various known browser flaws to install Trojans and Keyloggers in order to steal login credentials to other web applications."

The WHID project tracks Web application-related attacks and includes only publicly reported hacks that are associated with Web application security vulnerabilities. The report is based on 57 of these Web hacks from last year, up from 49 in 2007. So it's basically a snapshot of attacks that were reported and had some resolution, with most of the events coming from North America.

Most of the attacks were Web defacements (24 percent), followed by the theft of sensitive information (19 percent), planting malware (16 percent), imposing monetary loss (13 percent), imposing downtime (8 percent), and phishing (5 percent).

Not surprisingly, SQL injection was the most popular method or cause of attack (30 percent). Close behind, however, were "unknown" types (29 percent), which Breach Security attributes to the victims' inability to view Web traffic, or their preference to keep the details of the attacks private.

Cross-site scripting (XSS) represented a relatively small number of the attacks, with just 8 percent, followed by insufficient antiauthentication (5 percent), insufficient authentication (3 percent), cross-site request forgery (3 percent), denial-of-service (3 percent), and others.

"This data is important for assessing risk and prioritizing fixes," Barnett says. "Most lists have cross-site scripting at the top," which is a common flaw on Websites, he says. But XSS was not exploited by attackers nearly as widely as SQL injection, he says.

"Too much attention is paid to XSS, when SQL injection is by far the No. 1 issue," Barnett says.

Government, security, and law enforcement organizations represented the biggest sector suffering from these attacks (32 percent), but that may, in part, be due to their more stringent disclosure rules, the report says. Next were information services (13 percent), finance (11 percent), retail (11 percent), Internet (9 percent), and education (6 percent).

And government, for example, is often the victim of ideological hacking, while hosting providers and other Internet-based companies increasingly are getting hit by for-profit attacks.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message