SQL Injection

Common Attacks on Databases Unauthorized Privilege Escalation: Individuals attempting to increase their privileges by attacking vulnerable points in the DBMS. Privilege Abuse: Authorized users accessing/modifying data in an unauthorized way. Example: a TA lowering the grades of students they dislike. Denial of Service: An attempt to make database resources unavailable to intended users. Often a general attack which attempts to consume network, data, or processing resources through excessive/expensive queries. Weak Authentication: Impersonating an authorized user to gain access (password stealing / phishing).

SQL Injection This attack involves a malicious user providing unexpected input that modifies the SQL query to perform unintended actions. Lets imagine a simple authentification procedure that asks a user for a name (josh) and password (zoe1234) and checks if such an entry exists in the database: SELECT * FROM users WHERE name = 'josh' and password = 'zoe1234'; If the user supplies malicious input like: name (josh) and password (i_dont_know' or 'x'='x), here's the new query: SELECT * FROM users WHERE name = 'josh' and password = 'i_dont_know' or 'x'='x'; This changed query will always return rows and "authenticate" the user despite providing the wrong password. This type of SQL injection is called SQL manipulation.

Other types of SQL Injection Code Injection Adding additional SQL statements or commands to the existing SQL statement by exploiting a computer bug, which is caused by processing invalid data. This is often involves buffer overruns and stack overflows from unexpectedly large input payloads. Function Call Injection: This attack exploits the system-provided functions that many SQL queries invoke to cause unexpected behavior. http://www.informationsecuritybuzz.com/articles/detecting-and-investigating-sql-injection-attacks/

Risks from SQL Injection Database fingerprinting: The database response to injection can often reveal information regarding the version of DBMS being used and susceptibility to other attacks. Denial of Service: Malicious queries often take longer to process, allowing a denial of service. Bypassing authentication: Very common problem, where an attacker makes a query succeed despite not having authorization. Identifying injectable parameters: Error message responses (which should be turned off in production databases) can be used to identify the structures within the database vulnerable to attack. Executing remote commands: A remote user can execute stored database procedures and functions leading to control over the entire OS.

Solutions to SQL Injection Bind Variables Use parameterized statements Don't insert raw text into SQL statements, instead use parameters with will be bound to a variable when needed. It is both more performant and more secure. Filtering Input: Validate your input Remove escape characters (like the apostrophe) However, there are many escape characters, so you should use a built in to the database replace function. But even that isn't foolproof so bind your variables instead.