Slashdot Log In
500 Thousand MS Web Servers Hacked
Posted by
kdawson
on Fri Apr 25, 2008 10:48 AM
from the scream-and-shout dept.
from the scream-and-shout dept.
andrewd18 writes "According to F-Secure, over 500,000 webservers across the world, including some from the United Nations and UK government, have been victims of a SQL injection. The attack uses an SQL injection to reroute clients to a malicious javascript at nmidahena.com, aspder.com or nihaorr1.com, which use another set of exploits to install a Trojan on the client's computer. As per usual, Firefox users with NoScript should be safe from the client exploit, but server admins should be alert for the server-side injection. Brian Krebs has a decent writeup on his Washington Post Security Blog, Dynamoo has a list of some of the high-profile sites that have been hacked, and for fun you can watch some of the IIS admins run around in circles at one of the many IIS forums on the 'net."
Related Stories
This discussion has been archived.
No new comments can be posted.
500 Thousand MS Web Servers Hacked
|
Log In/Create an Account
| Top
| 332 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
ob... (Score:4, Funny)
Re:ob... (Score:5, Interesting)
If I run Firefox on Linux without NoScript, is there a danger?
Parent
Re:ob... (Score:5, Insightful)
The above quote is from the article link which lists "important sites that have been compromised". I think the important thing is that any site running MSSQL could potentially be compromised in a way that would affect a reader of that site who (a) does not have an updated web browser, or (b) doesn't have script disabled.
In 2008... why is it really so easy to put a damned single or double quote into a SQL form and then make it possible to execute your malicious code on that server? Shouldn't disabling this be a fundamental security rule for databases?
Parent
Re:ob... (Score:5, Insightful)
It is fundamental. It's called secure input handling, or sanitizing input. Just because it's a rule doesn't mean it is followed.
Parent
Re:ob... (Score:5, Funny)
Parent
Re:ob... (Score:5, Informative)
http://xkcd.com/327/ [xkcd.com]
Parent
Re:ob... (Score:5, Funny)
Parent
Re:More data needed (Score:4, Informative)
Create Procedure GetUserTelePhone(@UserName varchar(50))
Begin
Declare @sql varchar(300)
Set @sql = 'SELECT TelePhone From Users where UserName=''' + @UserName + ''''
return exec(@sql)
END
See, there you go, completely open to sql injection, and it's a stored procedure. The problem isn't that people aren't using stored procedures, it's that people are creating queries which result from the concatenation of strings and variables, which invariably leaves them open to attack. A much better way to do things, is to use prepared queries, either in you stored procedures, or just using prepared queries directly in the code.
Parent
Re:ob... (Score:4, Insightful)
"It Isn't Secure" is a tired old joke. But so is Microsoft!
Parent
Bias? (Score:5, Informative)
The tone of the blurb is not only biased but also counter-productive to promoting open source (as this appears to be its intention): by trying to criticise closed technologies not by highlighting their actual deficiencies but instead by spreading FUD, the whole community is done a disservice.
Re:Bias? (Score:4, Interesting)
Parent
Re:Bias? (Score:5, Informative)
Also, which browsers are affected? It sounds like most of the exploits being used against the browsers have already been patched. Is there a new one there?
Parent
Re:Bias? (Score:5, Insightful)
Its such a rediculous flamebait, I don't know what to say.
Parent
Re:Bias? (Score:5, Insightful)
It is NOT an IIS directed attack. At best, its a loose corelation statistic, and one thats pretty useless without comparing it to other references, such as other web servers.
Parent
Re:Bias? (Score:5, Funny)
Since we don't see the LAMP version spreading I think we can safely conclude that no web application written in PHP with a MySQL back-end is currently vulnerable to any type of SQL injection.
Parent
Re:Bias? (Score:5, Informative)
Parent
Re:Bias? (Score:5, Interesting)
If the attackers looked for servers that were advertising themselves as IIS, and/or attacked IIS vulnerabilities or bad administration practices, you'd have a point. But the fact that the servers were running IIS was little beyond a strong corelation.
Parent
Re:Bias? (Score:5, Informative)
Parent
Looking at the IIS forum... (Score:4, Informative)
However, it is now abundantly clear that the attack is NOT ASP-specific, and just because one of the vectors it tries is based on ActiveX does NOT mean it doesn't try other methods. It only means that the people who spotted it early spotted it trying that method. Although it's unlikely to have an attack library for multiple OS', it would be surprising if it didn't have some alternative action for when ActiveX isn't available.
I'm concerned about the number of Government sites that have been shown to be vulnerable, especially (as has been commented by others on Slashdot) a Canadian site dealing with national security. This attack is unlikely to cause any particular lasting harm, but stop and think. These are the sorts of sites that actually need to be secure. Even if not directly connected to internal secure networks (and I'd be willing to bet that far more are than are supposed to be), they are high-profile and for that reason alone are likely to be much more at-risk than other sites.
Most smaller websites are just point-of-presence and information sites. It's an irritant if they vanish for a while, but it's unlikely to hurt anything. Nobody is going to die if a blog site isn't available for an hour or so, unless they're a serious addict. No small vendor is going to lose business if their PDF datasheets aren't reachable for a little while. Adult sites risk making a one or two percent loss of webcam income out of their steady stream of millions. I seriously doubt anyone from the United Methodist church will suddenly become Mormon or Catholic because their primary website was hit.
Parent
Not really (Score:4, Informative)
Parent
Re:Not really (Score:5, Interesting)
As so has ASP.NET. I write (almost) all my database queries parametrized like this
SqlConnection conn = ... ...
SqlCommand cmd =
cmd.CommandText = "SELECT * FROM Foo WHERE Bar = @bar";
cmd.Parameters.AddWithValue("bar", barValue);
This way I'm pretty safe from SQL injection attacks. Add all the HTML encoding/decoding stuff to that and you can rest your nights peacefully.
Then enter the PHB. Now a days we stuff all the parameters straight to the DB procedure where they aren't sanitized at all. We build SQL query inside the stored proc by concatenating strings and call sp_execute to execute them. So all my earlier input validation and parameterized queries went down the drain. PHB's reasoning? - We trust our users.
Parent
Re:Bias? (Score:4, Insightful)
If users of open source software want to protect our largely well-deserved right to be smug, we have to be no less vigilant against these attacks than the proprietary chumps. This particular attack may only have hit MS servers, but this category of attack in general is frighteningly equal-opportunity.
We can't take our superiority for granted; we have to earn it every day.
Parent
Re:Bias? (Score:5, Interesting)
This has nothing to do with IIS, SQL or ASP, coding against SQL injection is the responsibility of web designer. Also it should be noted that ASP was originally released way back when with NT4.0 in 1996(v1) , 2.0 in 1997 and 3.0 in 2000 http://en.wikipedia.org/wiki/Active_Server_Pages [wikipedia.org].
With the newer ASP.NET MS was kind enough to provide several layers of protection against attacks such as SQL injection with both server side and client side validation applied to controls when built in the designer (by default).
Parent
The Trojan is hosted in China (Score:2, Informative)
Re:The Trojan is hosted in China (Score:5, Funny)
And I'm sure you meant Turkey.(http://en.wikipedia.org/wiki/Troy [wikipedia.org]).
Parent
LOL (Score:3, Funny)
Lolicious.
I once spend an hour trying to explain IIS/MS SQL Server admin what PHP/MySQL addslashes()/mysql_escape_string() do - all to no avail. He was absolutely sure it is sufficient to like in VB surround any string with single quotes and it all will be fine.
Now seeing that it's real fun for guys, I can only laugh.
So this isn't an IIS attack at all. (Score:2)
Thus, if I'm running a web app that doesn't rely on IIS for anything more than presentation, and am not using SQL in my authentication (say something like Terminal Services or GraphOn), I should be fine.
Correct?
Re:So this isn't an IIS attack at all. (Score:5, Informative)
Restrict the account that is used to access the database to the absolute minimum permissions it needs to run; using one set of credentials for insert/update/delete and another for selects is enough to foil a lot of exploits (I actually never allow deletes, just out of paranoia...I just update the record with an "inactive" flag, and purge them later with a local account).
For gods sake, don't allow a single account to access multiple databases, and even within the database make sure it only has access to the tables you're going to be using. I've seen more than a few MySQL injections that just dump the user table to the screen because some joker didn't think he needed to restrict access for "SELECT" statements.
Escape ALL data that comes from userland. This is your first line of defense, and it's where most people screw up. If you let an escape character past without it being escaped, your only protection is the privileges associated with the user account.
Abstract your data methods. If you just throw out random SQL queries all through your code, you're going to make a mistake somewhere. Make a single method that does your selects. Make a single method that does your inserts, etc. If it's only in ONE PLACE you can go over the code in extreme detail. If the queries are scattered through the code, you can't.
This is all just best practice stuff. The most important thing is to PAY ATTENTION and remember that one unsecured account can screw your entire server.
Parent
Seems to be effecting older versions of IIS... (Score:1)
I kid! I kid!
Honestly though, this is a little humiliating. I understand that things get out of control in large projects, but I thought most people nowadays should know that database input sanitizing now fell among those universal truths, including but not limited to: brushing your teeth, wearing a condom, et al.
Its unforgiving, but you really do have to sacrifice speed for security sometimes. That being said, I feel pretty bad for all those sys-admins/developers who are probably going to have a late nights tonight...and maybe for the next week or two.
Re:Seems to be effecting older versions of IIS... (Score:4, Funny)
Parent
wait a second (Score:1)
Article is misleading (Score:1)
That sucks (Score:1)
serious (Score:1)
These are a list of infected sites, don't click unless you know what you're doing. But I am worried when they affecting reasonably high traffic sites, whos visitors are not too likely to be running noscript.
This site makes me sick (Score:5, Insightful)
ASP.net has lots of built-in features to prevent SQL injection attacks (like bind parameters) and the ASP.net DB documentation specifically warns about this type of attack.
Anyone still getting hit with this in 2008 needs to be whacked on the head.
Re:This site makes me sick (Score:5, Insightful)
Parent
IIS bashing (Score:2, Insightful)
I've read a similar article on theregister.com: Web infection attacks more than 100,000 pages [theregister.co.uk]. There are also some interesting discussions over there.
This is a SQL injection, which is not specific to IIS. Any server-side program that fails to validate the input is subjected to this kind of exploit.
what does the trojan do? (Score:5, Insightful)
there seems to be a story 2 here: what the trojan will do in a few weeks to all of the IE users who visit these half a million sites
and, reading some of the links and finding that these trojan hosting domains are registered in china, there also seems to be a story 3: chinese hackers are pissed off
i got hacked shortly after the hainan island incident [wikipedia.org] in 2001. that is when the us spy satellite was bumped a chinese fighter, and was forced to land on hainan island (china). there was much chinese nationalist anger then, and it was taken out by hacking western sites with "f**k usa!" and the chinese flag replacing the main page
obviously, this hack is contemporaneous with the whole tibet riots/ olympic torch protests. that's the meat of this story, and that avenue seems unexplored as of yet. similar to the russian ddos of estonia due to the deprecation of a war statue in 2007 [slashdot.org]: the lesson is that, much like al qaeda and terrorism, cyber warfare is not so much a tool of any state government, but chest-thumping activity for ultranationalists and religious bigots and other organizations of cultural or national or religious chauvinism. the theme of the 21st century seems to be shaping up as partisan tribalism and extreme ideology reaching beyond the notions of sovereignty, statehood to go to war with each other in a novel ways
Re:what does the trojan do? (Score:5, Insightful)
The "Russian DDoS attacks of Estonia" were done by a few Estonian kids mad about some statues being moved around.
http://www.theregister.co.uk/2008/01/24/estonian_ddos_fine/ [theregister.co.uk]
There was no cyberwar, the Russian government had nothing to do with it, and every media source that mentioned it really needs to update their articles because the misinformation is causing far more harm than good.
Parent
500,000? Where'd that number come from? (Score:5, Informative)
I am not sure (Score:1)
and found 1,990,000 pages with this same script attack...as for how many servers this represents,
I don't know.
Still? (Score:1)
Any meaning to the site names? (Score:4, Interesting)
(Other meanings are possible as well, due to the large number of homophones in the language, but this is by far the most obvious meaning.)
SQL injection is not platform dependent (Score:2, Informative)
Oblig. XKCD (Score:1, Redundant)
It's even on the UN's website (Score:2, Interesting)
" As per usual?" (Score:2)
Interesting to note Windows admin responses (Score:2)
This is definitely not how most unix admins would react. If a machine is compromised (via whatever source) then a simple data restore is never good enough, unix admins know. The original vector must be identified and stopped. It's quite the contrast.
I've always maintained that a good unix guy can do anything on windows with a bit of training, but a windows guy will generally be completely out of his element in unix. Not sure why, exactly, as best practices are best practices.
following the breadcrumbs (Score:1, Troll)
My favorite amusement is:
Currently, Microsoft is not aware of any attacks attempting to exploit the potential vulnerability. Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a solution through a service pack, our monthly security update release process, or an out-of-cycle security update, depending on customer needs.
Thanks for that. Now that 500k servers got owned maybe you want to move on this sort of thing a little more seriously.
At the bottom they ask, How would you rate the usefulness of this content ? But there's no option for "a little late, eh?"
Though it DOES make me wonder if the publishing of this notice gave the idea to the makers of the malware. Makes a good case for not publishing a known vulnerability until either (1) its' in the wild already, or (2) you have a fix for it. Clearly neither of these were the case on Wednesday.
True story... (Score:2)
To his credit, the site actually worked and seemed fine, until you had a peek at the PHP code, which was truly horrific. I could overlook the nonsensical use of POST for things were GET was better suited or the crap variable naming, or the generally inefficient way of doing things - but what really got me was the complete absence of ANY input checking.
Simply put, the whole thing was completely vulnerable to SQL injection of the worst kind. I even checked his other works - all sites he'd ever done were vulnerable.
In the end, I had to spend a few more days myself just to clean the mess.
So, dear reader, if you don't know what SQL injections are - stop coding in whatever language you're using, right now. It doesn't matter if it's Ruby on Rails or ASP.NET. Please, please learn to do things properly. Security is not something you can learn later.
New AVG 8 free edition, the linkchecker catches it (Score:2)
Interestingly (and I've been looking at this attack all day) it seems to overwrite itself in the middle.
Andy
The real clue... (Score:1)
Just as dumb (Score:2)
Idiots running webservers (Score:1)
May relate to attack c.a. 11 april... (Score:2)
The real puzzle for me is *why* they haven't fixed the overwrite (unless it's a deliberate way of slowing growth).
Andy
SQL Injection = MS problem now?? (Score:1)
Take that PHP haters (Score:1)
Wait a minute.... could that possibly mean that PHP/ASP is not at fault when this stuff happens but the programmer(s)... where is this world coming to when the language can not be blamed anymore?
obnoxious headline (Score:1)
What an obnoxious headline. Either go with the numeric representation of the number (500,000) or spell it out properly (five hundred thousand). Didn't your English teacher tell you not to mix and match?
PHP Magic Quotes (Score:2)
What I cannot understand is why magic-quotes has been deprecated for PHP-6. Can anyone explain?
BTW, I'm not convinced by the advantages of stored procedures. Yes, they save you from SQL-injection risk (similar to magic-quotes), but the complexity of the resulting code is higher, and the readability is lower. Debugging cpomplex queries is hard enough already!
Boring (Score:2)
it finds a field named user, pass, ssn etc
to all text fields in all tables.
Patch your windows and use a web application fw (Score:1)
Re:epic lol (Score:5, Informative)
Parent
Re:epic lol (Score:5, Insightful)
Sure, he should know about SQL injection stuff - but even if he did, would he be able to fix it?
Parent
Re:epic lol (Score:3, Informative)
Anyway, as it has already been noted, this problem has nothing specifically to do with the IIS servers.
Two other notes:
FOSS is good, I agree. But FOSS, by default, is not always better than closed source solutions. Making a blanket statement like that is being just as close minded as the opposite camp.
Using M$ to represent Microsoft is soooooooo 1990s.
Parent
Re:Okay this is an honest question (Score:1)
Parent
Re:epic lol (Score:1, Redundant)
OS Security != Application Securty
Parent
Re:Okay this is an honest question (Score:2)
Second, IIS, since version 6, is amazingly secure, comparable with the likes of Apache. Its also the more straightforward platform to use as an ASP.NET server (obviously, unless you're into Mono), or to use along with a lot of fairly interesting technologies, such as TFS, Reporting Services, Sharepoints, etc.
On top of that, well, just by having a windows-based network, IIS is already "pre-configured". That is, aside for web server specific stuff, its already on your server, can be admin-ed the same way, etc. Adding a box with a different OS, a non-integrated web server, etc, is just overhead.
Same way as regardless of anything, if you were all java based, NOT using a java app server for your web apps would just be overhead, unless you have a damn good reasons.
Parent
Re:Okay this is an honest question (Score:1)
Admitted newbie question here, but why do people even RUN MS IIS?
Typically, people install MS IIS for a host of mostly good reasons.
1) They are a MS shop. That means they already have a big investment in MS IT training and their developers understand Windows.
2) They're using Microsoft development tools to create other parts of the application and they want the seemless integration that VS.Net and IIS give you. Good luck trying to debug PHP or other applications on Apache. It can be done, but its not nearly as easy as on Windows.
Windows XP makes a great desktop environment for the office, but where does Microsoft have any business making server software other than Domain Controllers for telling their desktop machines what to do?
By that logic, companies should never be allowed to work on anything other than their cash cow. Good job; you just destroyed capitalism with single sentence!
Parent
The dangers of Apache and PHP (Score:3, Insightful)
Add a healthy dose of misrepresentation, twisting of facts and oh-so-funny exaggeration (the IIS admins are running around in circles, LOLZORZ) and people like you can feel better about yourselves, at least for a few hours.
In the meantime, it's been 5+ years and no one has found an exploitable vulnerability in IIS.
I'm sure FOSS is better off this morning, thanks to kdawson, Slashdot and this type of misguided "advocacy". Might as well have twitter control the content of the front page.
Parent
Re:Okay this is an honest question (Score:1)
Clever troll... or do you just not think before you post?
IIS has its merits, just as apache does. ASP.net and other related technologies are a mainstay in the corporate environment whether you agree with it or not. They lend themselves well to rapid application development, and are well supported. Thus, it is cheap and easy to find talent within the field.
Regardless, your hosting platform will do nothing to fix bad code. The platform in this case, is irrelevent. Dont try to turn this into a soapbox to promote your own biased opinions.
FYI, I run several linux/apache servers as well as IIS/ASP servers. I am not impartial to either, as they each have their place in our environment.
Parent
Re:500 Thousand?! (Score:2)
I'm 1 hundred % shocked.
I don't see why you think it's weird. People write numbers like this all the time, especially when talking about monetary amounts. For instance, "Microsoft made $100 billion last year."
Parent