SQL Injection Attacks on the Rise

According to Secureworks, the number of SQL injection attacks, where the attacker adds Structured Query Language (SQL) code to a Web form input box to gain access to an organization’s resources or to make changes to data, are on the rise. These type of attacks can be used against many different types of web applications and using it, they can determine the structure and location of databases so they can either download the database or compromise the server. From January to March they block from 100 to 200 attacks a day, as of April that number has jumped to 1,000 to 8,000 attacks per day.

“The majority of the attacks are coming from overseas,” said Ramsey. “And although we certainly see a higher volume with other types of attacks, what makes the SQL Injection exploits so worrisome is that they are often indicative of a targeted attack.” This is a type of attack where the hacker has targeted a particular organization, versus a worm which spreads indiscriminately.

“Depending on the sophistication of the attacker, the online criminal can potentially gain access to a bank or utility company’s key customer databases containing social security numbers, account numbers, credit card numbers, email addresses, etc,” continued Ramsey.

Always secure your servers, and if you don’t know how, contract with someone who does, you’ll sleep better because of it.

Posted by Jimmy Daniels Posted in: Attacks, SQL, Security No Comments » July 2006