Feeds

Microsoft and HP tackle SQL-injection scourge

A modest proposal

Security for virtualized datacentres

With successful attacks against websites reaching epidemic levels, Microsoft and HP have released a free set of tools that help developers check their web applications for the mistakes that leave them open to exploits that can steal sensitive information and harm visitors.

The tools are designed to scan websites for vulnerabilities to so-called SQL injection attacks. Over the past six months, millions of web pages, some belonging to Fortune 500 companies or government agencies, have fallen prey to the attacks. As a result, unsuspecting visitors are directed to websites that silently try to install key loggers and other types of malware.

SQL injection attacks have proved hard to stop because they aren't perpetrated on any specific software platform. Rather, they target shoddy coding practices that fail to scrutinize user-supplied input for malicious code before passing it to web applications. ASP, PHP and CGI have all been known to be affected.

The tools come as ScanSafe, a company that monitors websites for malicious behavior, reports a new wave of SQL-injection attacks that harnesses infected PCs to search out and attack vulnerable websites. Sites that are compromised, in turn, install backdoors on visitors' machines, creating a worm-like characteristic.

The so-called Asprox attacks are distinct from a recent swarm of SQL attacks that over the past few months have hit the public information site for the Phoenix Mars Lander, the Wal-Mark, the Department of Homeland Security and the UK's Civil Service. The entry of Asprox suggests other malware gangs may be adopting the technique after seeing the success of their competitors.

That's where the new tools come in. Developers can use them to check their web apps for some of the most common mistakes. One tool is called Scrawlr and is a slimmed down version of an HP tool known as WebInspect. It scans websites for SQL-injection vulnerabilities by mimicking some of the most common attack methods.

A second is known as URLScan version 3.0 Beta, which blocks certain types of HTTP requests from being processed by Microsoft's Internet Information Services (IIS). That helps prevent potentially harmful requests from reaching the Web application that are downstream.

The third tool is a source code analyzer that detects ASP code that's susceptible to SQL-injection attacks.

Not everyone traveling in security circles has taken a liking to the new release. Mike Tracy, writing on the Matasano Chargen blog, questions whether two of the apps would be better dubbed "Half-Baked Code Analyzer" or "Web Application Firewall Lite" - the implication being they are too limited to be of any real benefit.

There's no doubt that these tools are no substitute for a more in-depth security posture that every website ought to have. But what the critics seem to be missing is that given the literally millions of pages that already have been marred, SQL injections could become the web equivalent of the bubonic plague. It's time for all of us to roll up our sleeves and do what we can. Microsoft and HP's release is a good start. ®

This story was updated to correct the name of the HP product from whence Scrawlr came. The commercial HP product is known as WebInspect.

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.