Feeds

Microsoft and HP tackle SQL-injection scourge

A modest proposal

Beginner's guide to SSL certificates

With successful attacks against websites reaching epidemic levels, Microsoft and HP have released a free set of tools that help developers check their web applications for the mistakes that leave them open to exploits that can steal sensitive information and harm visitors.

The tools are designed to scan websites for vulnerabilities to so-called SQL injection attacks. Over the past six months, millions of web pages, some belonging to Fortune 500 companies or government agencies, have fallen prey to the attacks. As a result, unsuspecting visitors are directed to websites that silently try to install key loggers and other types of malware.

SQL injection attacks have proved hard to stop because they aren't perpetrated on any specific software platform. Rather, they target shoddy coding practices that fail to scrutinize user-supplied input for malicious code before passing it to web applications. ASP, PHP and CGI have all been known to be affected.

The tools come as ScanSafe, a company that monitors websites for malicious behavior, reports a new wave of SQL-injection attacks that harnesses infected PCs to search out and attack vulnerable websites. Sites that are compromised, in turn, install backdoors on visitors' machines, creating a worm-like characteristic.

The so-called Asprox attacks are distinct from a recent swarm of SQL attacks that over the past few months have hit the public information site for the Phoenix Mars Lander, the Wal-Mark, the Department of Homeland Security and the UK's Civil Service. The entry of Asprox suggests other malware gangs may be adopting the technique after seeing the success of their competitors.

That's where the new tools come in. Developers can use them to check their web apps for some of the most common mistakes. One tool is called Scrawlr and is a slimmed down version of an HP tool known as WebInspect. It scans websites for SQL-injection vulnerabilities by mimicking some of the most common attack methods.

A second is known as URLScan version 3.0 Beta, which blocks certain types of HTTP requests from being processed by Microsoft's Internet Information Services (IIS). That helps prevent potentially harmful requests from reaching the Web application that are downstream.

The third tool is a source code analyzer that detects ASP code that's susceptible to SQL-injection attacks.

Not everyone traveling in security circles has taken a liking to the new release. Mike Tracy, writing on the Matasano Chargen blog, questions whether two of the apps would be better dubbed "Half-Baked Code Analyzer" or "Web Application Firewall Lite" - the implication being they are too limited to be of any real benefit.

There's no doubt that these tools are no substitute for a more in-depth security posture that every website ought to have. But what the critics seem to be missing is that given the literally millions of pages that already have been marred, SQL injections could become the web equivalent of the bubonic plague. It's time for all of us to roll up our sleeves and do what we can. Microsoft and HP's release is a good start. ®

This story was updated to correct the name of the HP product from whence Scrawlr came. The commercial HP product is known as WebInspect.

Remote control for virtualized desktops

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.