Slashdot Mirror
Massive SQL Injection Attack Compromises 380K URLs
Orome1 writes "A massive SQL injection attack campaign has been spotted by Websense researchers, and the number of unique URLs affected by it has risen from 28,000 when first detected yesterday, to 380,000 when the researchers last checked. The injected script redirects users that have landed on the various infected pages to the domain in the script, which then redirects them further to a website simulating an anti-malware check and peddling a rogue AV solution."
If each of those kurls is able to be refinished, I think that they could withstanding another couple injections, easily. Why is sensationalist media destroying our national merits!? Only on slashdot, and yes, I did read the article.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
I was trying to access www.AntiVirusPro2011.com when I got redirected here.
I want my money back. This isn't the future I was promised.
I had that phoney malware thing come in through a Flash/Javascript hole (thanks Microsoft for not rewriting or adopting Google's re-write, you jerks) and totally hose my PC a while back. I don't understand why this sort of behavior isn't being shut down promptly by the powers that be of the internet. They'll watch your music, the CIA will record every character transmitted or received (Hi, Bob!), but they can't seem to recognise the same stupid bogus anti-malware scan scam going from IP address A to IP address B.
Don't worry about 1984 and Big Brother, we aren't even close.
A feeling of having made the same mistake before: Deja Foobar
So, what's the attack? What SQL servers/CMS/languages are vulnerable?
<xml><I><am><so><damn>Web 2.0</damn></so></am></I></xml>
Just wondering, coz we seem to have been infected by plenty of rogue ACs recently. Oh wait - "rogue AV" - my mistake.
This seems to me like more of a JavaScript injection attack. Or am I missing something?
Very difficult to tell from the worthless article and summary.
Oh...and __fr15t p057__: suck it, bill gates!!!
Yes, I know I won't be the only one to say it.....
But seriously, if you don't know about binding params to SQL statements you shouldn't be writing public-facing websites. In any language. Ever.
throw new NoSignatureException();
should count it as one
I've stumbling more and more on those phony anit-virus warning and most the time they leave an executable in my temp directory - I'm always logged in as a client and MS Security essentials is pretty good at catching it - albeit long after it's on my hard drive :(
The sucky part is that it's been hitting legitimate websites - it's no longer just a problem with the porn or the naked celebrity (naked celebrity sites are the worst!)
I was looking at something completely innocuous (I think it was home improvement things) and I got that phony anti virus screen.
It's spreading.....
The fun part: it's kind of a hoot when the phony antivirus screen comes up showing a Windows XP window and file system ..... and you're on fedora 14/GNOME ...
Website use follows a Zipfian distribution. Less popular sites may be more vulnerable to attack since they'd be written by script kiddies.
So instead of telling us how many URLs have been hijacked, how about telling us how many end users are likely to be affected by this? It makes a large difference if one of the URLs is a popular website or just something a 10 year old patched together using Frontpage.
McAffe.com is totally safe.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
I know! "A new attack pushes a different song to each of 380,000 users with a link to a synchronization bot so that each user winds up with the 380,000 song set."
Wanna see how fast that gets taken care of?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
How about posting a screenshot of the anti-malware warning so we can be aware of it. I recently had to remove a piece of cruft from a user's laptop which, as far as I can tell, came from a Flash ad.
Since I know this user doesn't go to random bobssoftware.com sites, it had to come from an ad or a compromised site.
Also, would it have killed the editors to go to the source rather than some blog which scraped the source site?
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Let me inject my useless comment to a useles story using SQL right now...
yawn... this site is the FOX NEWS of tech... but people know that by now...
I often get my security software from pop ups.
You know...I would say people need to take a test and get a license before they can "surf the net" but look at how well that turned out for cars.
"If any question why we died, Tell them because our fathers lied."
I can't help but smile when I hear about how this kind of intrusion trouble hits those who have actually done it wrong. That's what they have done, otherwise they wouldn't be vulnerable to SQL injections (even aside from the fact that they are using SQL). I cringe when I see people do it so it feels good when they are punished. They don't know what they are doing, or at least they don't understand what they are doing well enough. What happens when I take in this parameter from there and use it over here as a part of my code? They don't seem to have thought that through, which I find intellectually evil.
Doing it wrong can still pass your test cases, if you are unlucky.
Firefox and NoScript to the rescue. Again...
If your server was one of the 380,000 hacked. I hope you will be back online soon.
15TW = 15,000 Nuclear Reactors. (Approx. one accident a month.)
Our website was hacked recently, via sniffed FTP passwords, not SQL injection. The site that our visitors were being redirected to was voictoall.com and another domain in the .cc tld. Does anybody know what the URLs of this attack were? I would be interested in knowing if it was the same folks who attacked us.
NoScript will protect you from this and all 3rd-party script injection, even when set very permissive (allow all scripts from the base domain)
there seems to be quite a few SQL implementations that don't support binding to arrays:
SELECT * FROM foo WHERE bar IN (?)
I asked the webmaster of bobby-tables.com about this. The reply was that apparently, you're supposed to construct the list of placeholders in the statement in parallel with the array of values to be substituted into those placeholders. But under some APIs *cough*mysqli*cough*, that can be far more painful than making a working function that escapes an entire array for use as right side of a WHERE expression and then carefully testing that function with every special character that your DBMS's manual mentions.
http://digg.com/eyewonder/interim.html?url=http://example.com/bad.js
cnn.com/eyewonder/interim.html
foxnews.com/eyewonder/interim.html
www.nbc.com/eyewonder/interim.html
news.cnet.com/eyewonder/interim.html
www.myspace.com/eyewonder/interim.html
You get the idea..
There's also another vulnerable file /flashtalking/ftlocal.html on many sites
I know! "A new attack pushes a different song to each of 380,000 users with a link to a synchronization bot so that each user winds up with the 380,000 song set."
Wanna see how fast that gets taken care of?
Yeah, have the RIAA or MPAA on your case and you've got a trillion dollar lawsuit coming! Brr!!! I'll take my chances with teh feds.
A feeling of having made the same mistake before: Deja Foobar
You are correct sir....
in php....
$new_string = preg_replace(“/[^a-zA-Z0-9\s]/”, “”, $string);
or simply use the http://docs.php.net/manual/en/function.mysql-real-escape-string.php function if you need full flexibility and to make sure it's clean and safe.
and done. in fact you are a lazy programmer if you dont sanitize your user input. Yes it's nice to add the extra security of setting up the DB correctly, but only a fool would not sanitize the user input to begin with.
Rule #1 is to treat all user input as hostile and dangerous. If you stick to that a lot of these pesky injection attacks go away.
Do not look at laser with remaining good eye.
http://xkcd.com/327/
This is the "but what about Unicode?" reply that you hoped no one would bother posting.
There are two more links which get injected via this particular hack. It is pretty common to see malicious hackers inject multiple links in one hack attempt.
http://www.stopthehacker.com/2011/03/31/lizamoon-hack-mass-sql-injection/
making a working function that escapes an entire array for use as right side of a WHERE expression and then carefully testing that function with every special character
simply use mysql_real_escape_string() if you need full flexibility and to make sure it's clean and safe.
That's what I do inside db_escape_list(), but the bobby-tables.com guy says it's not enough: one must use ? and only ?.
My hot beef injection attack only compromised 10-15 URL's
The article never claimed there were 380k servers hacked, it merely claimed there were 380k compromised unique URLs. If you follow the article, they are unique URLs as determined by a Google search. It could just as well be a hundred hacked servers with several thousand compromised pages each. Many of those pages could even be duplicates of one another.
The article is sorely missing any useful information as to what the attack is and how to protect against it....
http://stackoverflow.com/questions/3761064/need-help-with-this-xss-attack
Currently, it is aimed at IIS/MS-SQL web sites that have input forms that aren't validating the input and neutralizing HTML tags
The law suits won't start until everyone has all 380k songs. Its more profitable for them to wait to sue you than it is to start now.
You think the RIAA doesn't want you to have music, which is wrong. They want you to have all of their music, multiple times, they just want to make sure they can charge you as many ways as possible, including charging you even if you don't listen to any of their music (ref: tax on writable CDs).
They'll be happy to wait until all the transfers are complete so they can sue each infected person for illegally obtaining and distributing 380k songs at whatever the ridiculous fine per song they have is.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Not sure what the exact PHP syntax is, but in Perl:
my @list;
my $places = join(",", ("?")x@list);
$dbh->prepare("SELECT stuff FROM table WHERE stuff IN ($places)");
$dbh->execute(@list);
Maybe that's why there'll be a WinXP SP4 coming out tomorrow?
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
my $col_a_criteria = ' AND COLUMN_A IN (' . join(",", ('?') x @bind) . ') ' if scalar @bind;
$sth->prepare("select column_B from my_table where column_z = ? $col_a_criteria");
scalar @bind ? $sth->execute($col_z, @bind) : $sth->execute($col_z);
# It also wouldn't hurt to make sure that you are not exceeding the max SQL length or max values in an IN clause...
$dbh->execute(@list);
If only it were that easy. In PHP MySQLi, $stmt->bind_param() wants individual variables as parameters, not a single array. They have to be variables, not values, because they're passed by reference. Moreover, the first parameter is a string with one character stating the data type of each following variable to be passed into the statement. The function bind_param() is variadic, and all three argument counts (number of ?s, number of characters in type string, and number of variables following type string) all have to match, or MySQLi raises an exception. I guess the moral is that if you have the bobby-tables.com guy on your team, MySQLi isn't the best tool. If only I'd known this at the start of the big project.
Please see my reply to Anonymous Coward who suggested the same thing.
Not sanitizing input (any input, be it from a user or a remote site or a webservice or what have you) is asking for trouble, i see shit like this daily.
Replace
my $places = join(",", ("?")x@list);
With
my $places = ('?,'x$#list) . '?';
For an order of magnitude increase in efficiency. You don't want an array, don't create a temporary one, just go straight to the string you want.
However, if you've got such long lists that even that 'x' is expensive - just have a prepared string of ?,?,?,?,?,?,?.... and use substr of the appropriate length.
Also FatPhil on SoylentNews, id 863
Can the newer browsers security features that check XSS help? My parents computer still uses Firefox 3.x and they get a weird spyware bar installed that an anti virus program caught. I wonder if this has anything to do with that
http://saveie6.com/
http://xkcd.com/327/ Young Bobby Tables
Do not mock my vision of impractical footwear
Websense published an update to their previous article with more information about the attack. It includes the SQL injection code.
XML is like violence. If it doesn't solve the problem, use more. Junta
Relax, Is it possible for anyone to know how many machines or pages?
Approximation is an art with numbers like IP addresses and servers..
(Psst.. Give others the benefit of a doubt.)