500 Thousand MS Web Servers Hacked

andrewd18 writes "According to F-Secure, over 500,000 webservers across the world, including some from the United Nations and UK government, have been victims of a SQL injection. The attack uses an SQL injection to reroute clients to a malicious javascript at nmidahena.com, aspder.com or nihaorr1.com, which use another set of exploits to install a Trojan on the client's computer. As per usual, Firefox users with NoScript should be safe from the client exploit, but server admins should be alert for the server-side injection. Brian Krebs has a decent writeup on his Washington Post Security Blog, Dynamoo has a list of some of the high-profile sites that have been hacked, and for fun you can watch some of the IIS admins run around in circles at one of the many IIS forums on the 'net."

Re:Bias?

[Shados]

I agree, and that was my first reaction: "Wtf does IIS have to do with SQL injection". If nothing else, a LAMP stack would be more susceptible, not because of the servers, but because PHP didn't have mainstream prepared statements as part of a default standard install in its earlier versions, and now that it DOES have it, a lot of script kiddies or peanut gallery programmers aren't using them, as opposed to Java/.NET/Whatever which, while still having some issues with the same group of newbie developers, are prepared-statement centric in their development paradigms and documentation, thus reducing the amount of possible SQL injection significantly, unless the apps are made in legacy environments too.

Its such a rediculous flamebait, I don't know what to say.

This site makes me sick

[RzUpAnmsCwrds]

This site makes me sick sometimes. If this were a problem with PHP (which, mind you, it IS), we wouldn't be calling it a "vulnerability".

ASP.net has lots of built-in features to prevent SQL injection attacks (like bind parameters) and the ASP.net DB documentation specifically warns about this type of attack.

Anyone still getting hit with this in 2008 needs to be whacked on the head.

Re:Seems to be effecting older versions of IIS...

[Shados]

You don't even need to sanitize database input. Just use freagin prepared statements. There's no cleanup or validation necessary (for this particular vulnerability I mean, that is, sql injection).

IIS bashing

[gzipped_tar]

I've read a similar article on theregister.com: Web infection attacks more than 100,000 pages [theregister.co.uk]. There are also some interesting discussions over there.

This is a SQL injection, which is not specific to IIS. Any server-side program that fails to validate the input is subjected to this kind of exploit.

Re:This site makes me sick

[MrMunkey]

Anyone still getting hit with this in 2008 needs to be whacked on the head.

This is true of any language, not just ASP. You can easily prevent SQL injection with Perl, Python, PHP, etc.

Re:epic lol

[caluml]

Why do you think he's a developer? He sounds more like a sysadmin to me.
Sure, he should know about SQL injection stuff - but even if he did, would he be able to fix it?

Re:Bias?

[Anonymous Coward]

Agreed. I *hate* Microsoft and am as rabid a Free Software advocate as you will find, but code injection attacks are neither the fault of nor prevented by the OS or web server.

If users of open source software want to protect our largely well-deserved right to be smug, we have to be no less vigilant against these attacks than the proprietary chumps. This particular attack may only have hit MS servers, but this category of attack in general is frighteningly equal-opportunity.

We can't take our superiority for granted; we have to earn it every day.

Re:Bias?

[Shados]

No, i'm not trolling. My point is that the story itself is trolling. This isn't an IIS directed attack, it is a "bad programming" directed attack. The -same- attack, exactly, would work -regardless- of the server. You don't even need to CHECK which server is running on the machine for this attack to work, since the server is IRRELEVENT, and I was trying to demonstrate that. Nothing more.

It is NOT an IIS directed attack. At best, its a loose corelation statistic, and one thats pretty useless without comparing it to other references, such as other web servers.

what does the trojan do?

[circletimessquare]

ok, story 1 is a sql injection

there seems to be a story 2 here: what the trojan will do in a few weeks to all of the IE users who visit these half a million sites

and, reading some of the links and finding that these trojan hosting domains are registered in china, there also seems to be a story 3: chinese hackers are pissed off

i got hacked shortly after the hainan island incident [wikipedia.org] in 2001. that is when the us spy satellite was bumped a chinese fighter, and was forced to land on hainan island (china). there was much chinese nationalist anger then, and it was taken out by hacking western sites with "f**k usa!" and the chinese flag replacing the main page

obviously, this hack is contemporaneous with the whole tibet riots/ olympic torch protests. that's the meat of this story, and that avenue seems unexplored as of yet. similar to the russian ddos of estonia due to the deprecation of a war statue in 2007 [slashdot.org]: the lesson is that, much like al qaeda and terrorism, cyber warfare is not so much a tool of any state government, but chest-thumping activity for ultranationalists and religious bigots and other organizations of cultural or national or religious chauvinism. the theme of the 21st century seems to be shaping up as partisan tribalism and extreme ideology reaching beyond the notions of sovereignty, statehood to go to war with each other in a novel ways

Re:epic lol

[Shados]

How can you blame them however? Look at what THIS site (as in Slashdot) is doing. The headline implies that its an IIS hack. If you read the posts attached to this -very- article, a significant amount of people are replying acting like it IS a server issue, related to MS or some such.

When such misconceptions are so pervasive (even in -articles- on a geek web site like here!), obviously newbies are going to be confused all over the place.

Its a bit similar on how there's still so many SQL Server DBAs who think stored procedures are faster by design than dynamic SQL.

Re:Bias?

[willyhill]

This is not an IIS attack, it is an application attack. No more IIS specific than this [slashdot.org] one is Apache's fault, correct?

I love the difference in tone between the two submissions, and especially the "haha this is all a big joke, relax" tone of the comments on the other one.

It's unfortunate that Slashdot is becoming one big FUD-spewing machine.

Re:ob...

[RobBebop]

In other words, you can't rely on the site you are visiting to be safe.. so the onus is on the end user to make sure their PC is fully patched and as secure as possible.

The above quote is from the article link which lists "important sites that have been compromised". I think the important thing is that any site running MSSQL could potentially be compromised in a way that would affect a reader of that site who (a) does not have an updated web browser, or (b) doesn't have script disabled.

In 2008... why is it really so easy to put a damned single or double quote into a SQL form and then make it possible to execute your malicious code on that server? Shouldn't disabling this be a fundamental security rule for databases?

Re:500,000? Where'd that number come from?

[Unnngh!]

Yep...too bad there's not a firehose or some other way to vote to pull existing posts. This is wrong through and through and is just confusing and misleading.

The dangers of Apache and PHP

[willyhill]

Yeah sure [slashdot.org].

Add a healthy dose of misrepresentation, twisting of facts and oh-so-funny exaggeration (the IIS admins are running around in circles, LOLZORZ) and people like you can feel better about yourselves, at least for a few hours.

In the meantime, it's been 5+ years and no one has found an exploitable vulnerability in IIS.

I'm sure FOSS is better off this morning, thanks to kdawson, Slashdot and this type of misguided "advocacy". Might as well have twitter control the content of the front page.

Re:what does the trojan do?

[bjourne]

obviously, this hack is contemporaneous with the whole tibet riots/ olympic torch protests. that's the meat of this story, and that avenue seems unexplored as of yet. similar to the russian ddos of estonia due to the deprecation of a war statue in 2007 [slashdot.org]:

Please don't spread this unsubstantiated rumour. The only one who ever was found guilty of the dos attacks was an Estonian Russian script kiddie. The other allegations about Russia launching a cyber attack on Estonia were just that, allegations with no evidence what so ever.

Re:Not really

[geekoid]

Build an exploit for it and use it in front of your PHBs boss.

If you are under SarBox, remind them that this is an security audit issue.

This all can be done in a professional manner and not a 'get my stupid boss' manner.

IF you deal with any personal information, in your report you will make before the meeting, show the PR and legal nightmare that happens when data gets out.

Your boss should not be telling you how to program.

Re:ob...

[keithjr]

In 2008... why is it really so easy to put a damned single or double quote into a SQL form and then make it possible to execute your malicious code on that server? Shouldn't disabling this be a fundamental security rule for databases?

It is fundamental. It's called secure input handling, or sanitizing input. Just because it's a rule doesn't mean it is followed.

Re:ob...

[sm62704]

True, but the summary could have mentioned it. As it is, it's a ripe subject for humor. Only some folks here defend their choice of operating systems like others defend their wifes and children. Anyone who would get angry because someone jokes about someone else's product has some serious issues.

"It Isn't Secure" is a tired old joke. But so is Microsoft!

Re:what does the trojan do?

[Deanalator]

Please do not perpetuate hysteria.

The "Russian DDoS attacks of Estonia" were done by a few Estonian kids mad about some statues being moved around.

http://www.theregister.co.uk/2008/01/24/estonian_ddos_fine/ [theregister.co.uk]

There was no cyberwar, the Russian government had nothing to do with it, and every media source that mentioned it really needs to update their articles because the misinformation is causing far more harm than good.

In other words....

[Anonymous Coward]

The tone of the blurb is not only biased but also counter-productive to promoting open source (as this appears to be its intention): by trying to criticise closed technologies not by highlighting their actual deficiencies but instead by spreading FUD, the whole community is done a disservice.

In other words, it's a story perfectly suited for Slashdot and Slashdot's primary audience.

Re:Not really

[Anonymous Coward]

PHP has pretty much fixed SQL injection hacks, at least for MySQL, something TFA you quote mentions on page 74.

Please don't make me laugh. Try Googling this exact search phrase:

inurl:select inurl:where inurl:%20

PHP can give you all the protection in the world, but when you're designing your application with SQL query strings in the fucking URL, you're just hosed no matter what language you're using.

Re:ob...

[Firehed]

Interestingly, you can only do so much damage with PHP's handling of SQL statements. Namely, you can only run one statement per mysql_query() so while you could bypass a login with a ' OR 1=1 ' deal, Bobby Tables couldn't completely kill your DB. Doesn't stop code injection in the slightest which would be the easiest to prevent, but it's a start. Unfortunately it would be rather tricky to write software that knows when to escape characters and when I'm using variables in the statement safely which would break things if their contents were escaped.

Re:ob...

[jsebrech]

Well, the reality is that people who copy/paste together scripts don't take the time to learn the complete tutorial, they just copy out the parts they need, and often don't even look at the rest. In practice, by shunting security off to a separate lesson, it becomes a lesson most of the hobby coders never learn.

Besides, tutorials have no excuse anymore. In the PHP4 days it required extra code to be secure, but with PDO in PHP5, and bind variables, the easiest way to code things also happens to be the secure way. There are enough PHP5 web hosts out there that it makes sense to no longer support PHP4 other than for legacy systems.