SQL injection attack in 'third wave,' says IBM

A SQL injection attack that has affected at least a half-million Web sites has entered a "third wave" that's more resistant than previous versions to traditional security measures, according to IBM security researchers.

"I've been tracking SQL injections for the last five or six years. This is some of the most intricate obfuscation I've ever seen," says David Dewey, research manager for the X-Force technology at IBM's Internet Security Systems division.

A SQL injection is an attack against a database-driven Web site in which the hacker executes unauthorized SQL commands by taking advantage of insecure code on systems connected to the Internet.

When Dewey talks about obfuscation, he's referring to hackers hiding attacks behind seemingly valid functionality. The attacks evolve as hackers change the SQL commands used to accomplish their goals, but the result is the same.

SQL injections are among the most common Web attacks, partly because a hacker needs little beyond a Web browser and knowledge of SQL queries. These most recent attacks, however, are "extremely complex" and hard to detect until it's too late, Dewey says.

Hackers are randomly targeting IP addresses throughout the world, looking for any Web site that would accept such an injection, Dewey says. Many successful, widely trusted retail Web sites are being affected. Internet surfers who navigate to infected sites are redirected to "exploitation sites" that simply look broken, with error messages and missing content. The users then are attacked with malware and added to a growing botnet, he says.

It happens so fast there's no way to avoid it. "It's the speed of light," Dewey says. The SQL injections began on a small scale in January, he says. In April, hackers modified their commands to evade security measures, and the number of attacks went "through the roof," he adds.

Less than two weeks ago, IBM researchers found the latest version, which Dewey calls the third wave. While the new version of the attack is designed to sidestep security measures put in place for the second wave, once a Web site has been hit it's pretty obvious. "This thing does not try to be sneaky," he says. "It basically tries to obliterate all of your database records and inject its own content into all of your database records." Back-end data is destroyed, whether it be customer accounts, or something simple, like the content of a blog.

Autoweb, a UK-based advertising and marketing site victimized by a recent SQL injection, recovered only after a series of countermeasures, from blocking the Chinese IP addresses where the attacks originated, to finding a developer capable of fixing a vulnerability in its Web application.

The X-Force team at IBM recently made some changes in how it detects SQL injections, changes that allowed its technology to find the latest attacks, Dewey says. Numerous other vendors are releasing updates every week to combat the problem, he notes. "With our protection, they haven't ever evaded us," he says, "so far as we know."