United Nations Website Contains SQL Injection Flaws Three Years After Hack, Researcher Says

Three years after the United Nations' website was defaced by activist hackers using a SQL injection attack, the site still contains multiple instances of these vulnerabilities.

Security researcher Robert Graham, CEO of Errata Security, did his now-annual checkup on the UN site and found that while the UN had removed the bug that was exploited in the August 2007 attack, the site is still rife with multiple SQL injection vulnerabilities.

In the 2007 defacement, attackers replaced then-Secretary General Ban Ki-Moon's speeches with some of their own calling for "peace forever" and "no war." The attackers exploited a SQL injection bug.

"In what's become a yearly blogpost, the UN still has not fixed the SQL injection problems that led to their website being hacked back in 2007," Graham blogged today. "For example, if you click on 'print this article', then use that URL instead, the SQL injection still works."

Graham points to this example, where he shows how the Secretary-General speeches section of the site could easily be hacked by abusing the SQL injection flaws there.

Giorgio Maone, who develops the popular NoScript add-on for Firefox and a software developer working for InformAction, says the SQL injection-ridden UN website case is an example of how some organizations rely too heavily on setting rules to virtually "patch" their sites with Web application firewalls (WAFs) rather than actually fixing them. He says the bug used in the defacement was left unfixed for several months or more.

"The U.N. recurring incidents are a glaring example of this mentality: the bug which caused the original defacement I covered three years ago had gone unpatched for a long time ... instead they choose to deploy a WAF with a really naive rule, which made the vulnerability appear to be gone but was extremely easy to work around," Maone says. "Don't get me wrong: WAFs do have their utility as a first line of protection -- to understand you're under attack (via logging and smart alerts), and to take time with virtual patches while you actually fix your code for good, but they can't be taken as the alpha and the omega of your Web application security."

In addition to WAFs, organizations such as the UN should be educating developers about security best practices, and hiring out third-party assessments of the apps to audit the code and provide solutions for fixing bugs, he says.

The UN had not responded to press inquiries on the issue at the time of this posting.

Meanwhile, SQL injection can be used for much worse than defacement. Maone says planting downloadable malware on the site, installing a JavaScript sniffer on web pages to steal U.N. employees, or issuing phony statements purportedly from UN representatives are just a few examples of how the bugs could be used for more nefarious and damaging purposed against the organization.

Large organizations often do struggle to keep up with their Web security. Jeremiah Grossman, founder and CTO of WhiteHat Security, says it may be a matter of the UN not having the resources to fix its vulnerabilities, or that it has outsourced its web development and the provider isn't resolving the problems. "Fixing the [web security] issues is the famous number two thing challenging people in the security of websites," Grossman says. "It's always a resource issue: it's finding the time and money to fix them, and negotiating for developer time to do so." That can come down to choosing between taking a developer off of a revenue-generating coding project to fix a vulnerability that may or may not be exploited, for example, he says.

InformAction's Maone says the more bureaucratic organizations like the UN have even more challenges with this. "The higher you go in bureaucratized organizations, the more difficult it becomes introducing changes with the necessary agility," he says. "Really, preventing trivial SQL injections like the ones we're talking about is really easy, provided that developers are minimally trained."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.