SQL Injection Remains Scary Back-Door Security Threat

I got onto the subject of SQL injection thanks to Intel software blogger Kenneth Graf, who caught my attention with a post provocatively entitled, "Your password is potentially dangerous." (Who knew ? :) While SQL injection is nothing new, it remains a downright terrifying security threat, since it's a very easy way for hackers to get into the database behind your Web site.Explained as simply as possibly, SQL injection means a hacker can get into your database by logging into your site using funky character sequences which replace numeric input which the database is expecting (like your user name or password) with a string that instead manipulates a SQL statement. Presto, the hacker is into the database.

Programmers can protect against this stuff by forcing strongly typed user names and passwords (i.e., no funky characters allowed). They can also better isolate the database from user input, so that stuff people type in can't get directly into any SQL statements.

That's the theory. However, despite the fact that this type of vulnerability has been known for a long time, SQL injection breaches still pop up in the news with alarming regularlity. Back in April, a wave of SQL injection attacks hit half a million Microsoft IIS-powered sites. In May, thousands of Chinese Web sites were attacked via implanted malware.

The point is, this stuff is fairly easily protected against, but also often ignored by admins, since it's not a sexy security threat that's top of mind of most people. Okay, I've made my pitch, now here are a couple of relevant videos. The first walks you through a SQL injection site-breach. When you note how easy it is to get in, I think you'll agree with me that this is scary stuff. The second vid is by security expert Matt Fisher, speaking at the 2006 ToorCon.org hacker security conference.

What's your take? Please leave a comment below, or shoot me an e-mail directly at [email protected].

Like this blog? Subscribe to its RSS feed, here.

For a mobile experience, follow my daily observations on Twitter.

Check out my tech videos on this YouTube channel.