Data Driver

Blog archive

Despite Help From Microsoft, SQL Injections Remain A Threat

While the spate of SQL injection attacks appears to have died down from its peak earlier this year, it is still a considerable problem that should be on the radar of all database developers and DBAs.

Any SQL-based database server is vulnerable to a SQL injection, but the ones that have wreaked havoc this year have been directed at Microsoft's SQL Server via malicious code in a SQL query string, directed to the database via a Web app.

As reported last week, the number of unpatched Web sites that are exposing malicious code still is alarmingly high -- some seven of 10 Web apps are unsafe, according to Cenzic's Intelligent Analysis Lab report.

Of particular concern to database developers is the fact that one in five of those measured for by Cenzic had SQL injection applications. The finding comes as Microsoft released a new security filter for its Internet Information Services (IIS) Web server aimed at thwarting such attacks.

Microsoft's UrlScan 3.0 is an upgraded version of a five-year-old tool that now examines the query string in a SQL query request. That allows developers to create more granular rules for specific types of requests, Wade Hilmo, senior development lead on Microsoft's IIS team, which wrote UrlScan, told Redmond Media Group online editor Kurt Mackie. "For example, you can write a rule that only applies to ASP pages or PHP pages," Hilmo says.

While a step in the right direction, Kevin Beaver, founder and principal information security consultant of Atlanta-based Principle Logic LLC, tells Mackie that the features in UrlScan are rather basic. "It's good the features are now available, but getting admins and developers to actually upgrade is a whole different issue," Beaver tells Mackie.

And therein lies the problem. Until patching systems becomes a priority at the CIO levels, hackers are going to continue to have a field day.

Is your organization taking these threats more seriously? Drop me a line.

Posted by Jeffrey Schwartz on 09/03/2008


comments powered by Disqus

Featured

  • Windows Community Toolkit v8.2 Adds Native AOT Support

    Microsoft shipped Windows Community Toolkit v8.2, an incremental update to the open-source collection of helper functions and other resources designed to simplify the development of Windows applications. The main new feature is support for native ahead-of-time (AOT) compilation.

  • New 'Visual Studio Hub' 1-Stop-Shop for GitHub Copilot Resources, More

    Unsurprisingly, GitHub Copilot resources are front-and-center in Microsoft's new Visual Studio Hub, a one-stop-shop for all things concerning your favorite IDE.

  • Mastering Blazor Authentication and Authorization

    At the Visual Studio Live! @ Microsoft HQ developer conference set for August, Rockford Lhotka will explain the ins and outs of authentication across Blazor Server, WebAssembly, and .NET MAUI Hybrid apps, and show how to use identity and claims to customize application behavior through fine-grained authorization.

  • Linear Support Vector Regression from Scratch Using C# with Evolutionary Training

    Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the linear support vector regression (linear SVR) technique, where the goal is to predict a single numeric value. A linear SVR model uses an unusual error/loss function and cannot be trained using standard simple techniques, and so evolutionary optimization training is used.

  • Low-Code Report Says AI Will Enhance, Not Replace DIY Dev Tools

    Along with replacing software developers and possibly killing humanity, advanced AI is seen by many as a death knell for the do-it-yourself, low-code/no-code tooling industry, but a new report belies that notion.

Subscribe on YouTube