Slashdot Mirror
Massive SQL Injection Attack Compromises 380K URLs
Orome1 writes "A massive SQL injection attack campaign has been spotted by Websense researchers, and the number of unique URLs affected by it has risen from 28,000 when first detected yesterday, to 380,000 when the researchers last checked. The injected script redirects users that have landed on the various infected pages to the domain in the script, which then redirects them further to a website simulating an anti-malware check and peddling a rogue AV solution."
If each of those kurls is able to be refinished, I think that they could withstanding another couple injections, easily. Why is sensationalist media destroying our national merits!? Only on slashdot, and yes, I did read the article.
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
I was trying to access www.AntiVirusPro2011.com when I got redirected here.
I want my money back. This isn't the future I was promised.
I had that phoney malware thing come in through a Flash/Javascript hole (thanks Microsoft for not rewriting or adopting Google's re-write, you jerks) and totally hose my PC a while back. I don't understand why this sort of behavior isn't being shut down promptly by the powers that be of the internet. They'll watch your music, the CIA will record every character transmitted or received (Hi, Bob!), but they can't seem to recognise the same stupid bogus anti-malware scan scam going from IP address A to IP address B.
Don't worry about 1984 and Big Brother, we aren't even close.
A feeling of having made the same mistake before: Deja Foobar
So, what's the attack? What SQL servers/CMS/languages are vulnerable?
<xml><I><am><so><damn>Web 2.0</damn></so></am></I></xml>
Just wondering, coz we seem to have been infected by plenty of rogue ACs recently. Oh wait - "rogue AV" - my mistake.
This seems to me like more of a JavaScript injection attack. Or am I missing something?
Very difficult to tell from the worthless article and summary.
Yes, I know I won't be the only one to say it.....
But seriously, if you don't know about binding params to SQL statements you shouldn't be writing public-facing websites. In any language. Ever.
throw new NoSignatureException();
Website use follows a Zipfian distribution. Less popular sites may be more vulnerable to attack since they'd be written by script kiddies.
So instead of telling us how many URLs have been hijacked, how about telling us how many end users are likely to be affected by this? It makes a large difference if one of the URLs is a popular website or just something a 10 year old patched together using Frontpage.
McAffe.com is totally safe.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
I know! "A new attack pushes a different song to each of 380,000 users with a link to a synchronization bot so that each user winds up with the 380,000 song set."
Wanna see how fast that gets taken care of?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
How about posting a screenshot of the anti-malware warning so we can be aware of it. I recently had to remove a piece of cruft from a user's laptop which, as far as I can tell, came from a Flash ad.
Since I know this user doesn't go to random bobssoftware.com sites, it had to come from an ad or a compromised site.
Also, would it have killed the editors to go to the source rather than some blog which scraped the source site?
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
I often get my security software from pop ups.
You know...I would say people need to take a test and get a license before they can "surf the net" but look at how well that turned out for cars.
"If any question why we died, Tell them because our fathers lied."
Firefox and NoScript to the rescue. Again...
If your server was one of the 380,000 hacked. I hope you will be back online soon.
15TW = 15,000 Nuclear Reactors. (Approx. one accident a month.)
Maybe you should try noscript to block unwanted 3rd party scripts.
NoScript will protect you from this and all 3rd-party script injection, even when set very permissive (allow all scripts from the base domain)
there seems to be quite a few SQL implementations that don't support binding to arrays:
SELECT * FROM foo WHERE bar IN (?)
I asked the webmaster of bobby-tables.com about this. The reply was that apparently, you're supposed to construct the list of placeholders in the statement in parallel with the array of values to be substituted into those placeholders. But under some APIs *cough*mysqli*cough*, that can be far more painful than making a working function that escapes an entire array for use as right side of a WHERE expression and then carefully testing that function with every special character that your DBMS's manual mentions.
I know! "A new attack pushes a different song to each of 380,000 users with a link to a synchronization bot so that each user winds up with the 380,000 song set."
Wanna see how fast that gets taken care of?
Yeah, have the RIAA or MPAA on your case and you've got a trillion dollar lawsuit coming! Brr!!! I'll take my chances with teh feds.
A feeling of having made the same mistake before: Deja Foobar
sniffed FTP... wow... why were you not using sftp or ssh? you dont use FTP for ANYTHING but public file repository where anonymous is the username.
Do not look at laser with remaining good eye.
You are correct sir....
in php....
$new_string = preg_replace(“/[^a-zA-Z0-9\s]/”, “”, $string);
or simply use the http://docs.php.net/manual/en/function.mysql-real-escape-string.php function if you need full flexibility and to make sure it's clean and safe.
and done. in fact you are a lazy programmer if you dont sanitize your user input. Yes it's nice to add the extra security of setting up the DB correctly, but only a fool would not sanitize the user input to begin with.
Rule #1 is to treat all user input as hostile and dangerous. If you stick to that a lot of these pesky injection attacks go away.
Do not look at laser with remaining good eye.
http://xkcd.com/327/
making a working function that escapes an entire array for use as right side of a WHERE expression and then carefully testing that function with every special character
simply use mysql_real_escape_string() if you need full flexibility and to make sure it's clean and safe.
That's what I do inside db_escape_list(), but the bobby-tables.com guy says it's not enough: one must use ? and only ?.
The article never claimed there were 380k servers hacked, it merely claimed there were 380k compromised unique URLs. If you follow the article, they are unique URLs as determined by a Google search. It could just as well be a hundred hacked servers with several thousand compromised pages each. Many of those pages could even be duplicates of one another.
The article is sorely missing any useful information as to what the attack is and how to protect against it....
http://stackoverflow.com/questions/3761064/need-help-with-this-xss-attack
Currently, it is aimed at IIS/MS-SQL web sites that have input forms that aren't validating the input and neutralizing HTML tags
The law suits won't start until everyone has all 380k songs. Its more profitable for them to wait to sue you than it is to start now.
You think the RIAA doesn't want you to have music, which is wrong. They want you to have all of their music, multiple times, they just want to make sure they can charge you as many ways as possible, including charging you even if you don't listen to any of their music (ref: tax on writable CDs).
They'll be happy to wait until all the transfers are complete so they can sue each infected person for illegally obtaining and distributing 380k songs at whatever the ridiculous fine per song they have is.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Maybe that's why there'll be a WinXP SP4 coming out tomorrow?
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
my $col_a_criteria = ' AND COLUMN_A IN (' . join(",", ('?') x @bind) . ') ' if scalar @bind;
$sth->prepare("select column_B from my_table where column_z = ? $col_a_criteria");
scalar @bind ? $sth->execute($col_z, @bind) : $sth->execute($col_z);
# It also wouldn't hurt to make sure that you are not exceeding the max SQL length or max values in an IN clause...
$dbh->execute(@list);
If only it were that easy. In PHP MySQLi, $stmt->bind_param() wants individual variables as parameters, not a single array. They have to be variables, not values, because they're passed by reference. Moreover, the first parameter is a string with one character stating the data type of each following variable to be passed into the statement. The function bind_param() is variadic, and all three argument counts (number of ?s, number of characters in type string, and number of variables following type string) all have to match, or MySQLi raises an exception. I guess the moral is that if you have the bobby-tables.com guy on your team, MySQLi isn't the best tool. If only I'd known this at the start of the big project.
Please see my reply to Anonymous Coward who suggested the same thing.
Not sanitizing input (any input, be it from a user or a remote site or a webservice or what have you) is asking for trouble, i see shit like this daily.
Replace
my $places = join(",", ("?")x@list);
With
my $places = ('?,'x$#list) . '?';
For an order of magnitude increase in efficiency. You don't want an array, don't create a temporary one, just go straight to the string you want.
However, if you've got such long lists that even that 'x' is expensive - just have a prepared string of ?,?,?,?,?,?,?.... and use substr of the appropriate length.
Also FatPhil on SoylentNews, id 863
No, Eyewonder is one of their advertising providers. And we all know how shitty advertising providers are.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Can the newer browsers security features that check XSS help? My parents computer still uses Firefox 3.x and they get a weird spyware bar installed that an anti virus program caught. I wonder if this has anything to do with that
http://saveie6.com/
Websense published an update to their previous article with more information about the attack. It includes the SQL injection code.
XML is like violence. If it doesn't solve the problem, use more. Junta
now in 3D :)