{"id":12278,"date":"2020-04-30T14:27:00","date_gmt":"2020-04-30T18:27:00","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=12278"},"modified":"2020-04-30T14:32:28","modified_gmt":"2020-04-30T18:32:28","slug":"sql-injection-attack-what-it-is-how-to-protect-your-business","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/sql-injection-attack-what-it-is-how-to-protect-your-business\/","title":{"rendered":"SQL Injection Attack: What It Is &#038; How to Protect Your Business"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong>Web-applications attacks, including SQL injection attacks, more than doubled in 2019, according to data from SonicWall<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Taking into account the trends for more and more businesses going online, the number of applications that will be used is also projected <a href=\"https:\/\/www.sonicwall.com\/2020-cyber-threat-report\/\">to increase in 2020<\/a>, as are the web-security threats that go with them. That\u2019s why it\u2019s essential to protect your website, application, or any other instance that may be publicly accessible from these threats, which include the use of SQL injection attacks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this blog, we\u2019ll explore the topic of SQL injection attacks \u2014 what it is, how an SQL injection attack occurs (using a basic example), and why these attacks are so devastating. We\u2019ll also share some SQL injection prevention tips you can use to keep your data safe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Is SQL Injection (or an SQL Injection Attack)?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you try to Google \u201cWhat is an SQL injection attack,\u201d you will probably see a lot of results for tech-savvy people and talking about the syntax change within the SQL queries to perform authorized commands. But let\u2019s try to explain it in simpler terms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine that you\u2019re going to the bank to perform the wire transfer to your friend and need to give written instructions. You go to the accountant, verify your identity and give them the paper with instructions. But after you leave, some cons have modified your instructions. They added the line that apart from the mentioned transfer, one more transaction of $700 should go to some account you don\u2019t know.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since your identity was verified, the accountant takes your instructions and performs the two transactions \u2014 both the legitimate and fraudulent ones.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But what does all of this mean in terms of an SQL injection attack? Being a human, you will probably check the instructions before giving them to the accountant to make sure that everything is fine. Unfortunately for you, however, a web application does not have this capability, and if the server is not protected, the attack is successful. So, if we translate it to the context of SQL injection, it\u2019s about \u201cinjecting\u201d an SQL query (also known as a \u201ctrue statement\u201d) via the input data from the client to the application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A successful SQL injection exploit can:<\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<ul class=\"wp-block-list\"><li>Read sensitive data from the database;<\/li><li>Modify database data (insert\/update\/delete);<\/li><li>Execute administrative<a href=\"https:\/\/www.sentryone.com\/data-ops-overview\" target=\"_blank\" rel=\"noreferrer noopener\"> operations<\/a> on the database (such as shutdown the database management system, or DBMS);<\/li><li>Recover the content of a given file that\u2019s present on the DBMS file system; and (in some cases)<\/li><li>Issue commands to the operating system.<\/li><\/ul>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Although these types of attacks are nothing new, they still pose major threats to businesses and users alike. According to the<a href=\"https:\/\/www.us-cert.gov\/sites\/default\/files\/publications\/Practical-SQLi-Identification.pdf\" target=\"_blank\" rel=\"noreferrer noopener\"> U.S. Computer Emergency Readiness Team (CERT)<\/a>:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u201cOne reason for the persistence of these problems is that their underlying causes can be found in almost any web application, regardless of implementation technology, web framework, programming language, or popularity.\u201d<\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">When analyzing<a href=\"https:\/\/owasp.org\/www-project-top-ten\/\" target=\"_blank\" rel=\"noreferrer noopener\"> OWASP\u2019s Top 10<\/a> Web Application Security Risk publication, you\u2019ll notice that SQL injection was listed as the #1 web application security risk back in 2013. It\u2019s stayed in the #1 spot even four years later in 2017 when the Top 10 list was last republished. It would be interesting to see where it will fall on the list in the future when the list gets republished again.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How Does an SQL Injection Attack Happen?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding<a href=\"https:\/\/owasp.org\/www-community\/attacks\/SQL_Injection\" target=\"_blank\" rel=\"noreferrer noopener\"> how an SQL injection attack works<\/a> is crucial to being able to identify any exploitable vulnerabilities within your web apps and forms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s break down how this attack works. We\u2019ll start by exploring how a user\u2019s information is added and retrieved from a database. From there, we\u2019ll break down how a threat actor uses SQL injection attacks to gain access to sensitive information:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>How to Add and Retrieve Information from a User Database<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">On the account creation page, once a user is created, their information is stored in a database along with all the other users. With that being said, whenever a new user is created, an insert query is running to add the user to the database as shown below (take note of the table and columns names):<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"64\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-1-1024x64.png\" alt=\"\" class=\"wp-image-12281 addshadow\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-1-1024x64.png 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-1-300x19.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-1-768x48.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-1.png 1423w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">After<a href=\"https:\/\/www.sentryone.com\/products\/features\/top-sql\" target=\"_blank\" rel=\"noreferrer noopener\"> understanding how the data is inserted<\/a> into the database, let&#8217;s see how it is read from the database by looking at the login screen. On the login screen, users will be able to log in to the application using the username and password combination supplied in the account creation step. To display this information, a select query is run to retrieve the appropriate user&#8217;s information from the database as shown below where user JohnDoe12 is trying to login (take note of quotations):<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"808\" height=\"81\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-2.png\" alt=\"\" class=\"wp-image-12282 addshadow\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-2.png 808w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-2-300x30.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-2-768x77.png 768w\" sizes=\"auto, (max-width: 808px) 100vw, 808px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>How an SQL Injection Attack Works<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is where SQL injection comes into play. If you notice in the query above, we return information about the user if their username and password are contained in the database. Based on how that query was written, the user\u2019s input was directly inserted into the query statement, which is a no-go. Because of this, an attacker can insert query-altering information to get the query to return unexpected results (as shown below):<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"862\" height=\"91\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-3.png\" alt=\"\" class=\"wp-image-12283 addshadow\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-3.png 862w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-3-300x32.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-3-768x81.png 768w\" sizes=\"auto, (max-width: 862px) 100vw, 862px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of typing in JohnDoe12, the attacker types in \u201c<strong>&#8216; OR 1=1 &#8212;<\/strong>&#8221; as the username. The single quotation to begin the attacker\u2019s query ends the username parameter, making the query search for users where their username is <strong>\u2018\u2019 <\/strong>or blank.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the single quotation, the attacker types <strong>OR 1=1<\/strong>. Using common math, we know 1 will always equal 1. With that being said, this expression evaluates to true. The double hyphen (<strong>&#8212;<\/strong>) tells the query to comment out and ignore the remaining text, hence the green color.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Understanding these parts of the attacker\u2019s query, the query would search for users with no username or where TRUE. Because True will always evaluate to true, the query would return all (*) users from the Users table.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s a great video from Hacksplaining, which is a demonstration that breaks down a simple SQL injection attack:<\/p>\n\n\n\n<figure class=\"wp-block-embed-youtube wp-block-embed is-type-video is-provider-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"What Is SQL Injection?\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/wcaiKgQU6VE?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Example: An SQL Inject Attack Scenario<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s go through a basic example together to show how a<a href=\"https:\/\/www.imperva.com\/learn\/application-security\/sql-injection-sqli\/\" target=\"_blank\" rel=\"noreferrer noopener\"> SQL injection attack<\/a> would happen. In this scenario, you\u2019re an employee for a credit monitoring company. Your company&#8217;s main product is a website where users can sign up for free credit monitoring.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get started with the basic tier, users have to create an account where they give their name, current address, email address, username, password, and social security number. For those customers that would like to set up a premium tier, they have to give the same information as basic users, plus their banking information for Pro charges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Why would someone want to attack a credit monitoring company you may ask? One word, data! Your company is a virtual gold mine for attackers. Not only does your company have customer emails and home addresses, but they also have social security numbers and banking information.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Why SQL Injection Attacks Are So Devastating<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The consequences of SQL injection attacks may be disastrous. Personal information, passwords, and other internal sensitive data can be used to commit various crimes starting from identity theft to financial fraud. Moreover, it affects not only people whose info was stolen but also the company that was a victim of a security breach. Apart from frustrated customers, lawsuits, and compensation expenses, companies face significant reputation loss that may lead to getting out of the business.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cybercriminals hunt personal information due to the reason that the social security number, also known as an SSN, never gets old and it\u2019s easy to commit crimes in several months or years after stealing this information. This differs from other types of sensitive information, such as bank info and credit card details, which require more timely action on the part of criminals who wish to use this information to commit fraud or to sell the obtained data to someone else. In the hacker community, there are ecommerce stores in Darknet where people are selling the stolen information to be able to act on the received info with malicious intentions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now that we understand what an SQL inject attack is and why it\u2019s so devastating, let\u2019s dive deeper into the precaution measures that can help to avoid these attacks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>4 SQL Injection Prevention Tips to Mitigate an Attack<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In order to make your web application secure and unexposed to SQL injection attacks, there are certain actions that need to be performed to defend your server:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Say No to Dynamic SQL and Yes to Prepared Statements<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Do not include users\u2019 inputted data directly into SQL queries. In order to achieve that, it\u2019s necessary to disable \u201cdata interpretation\u201d so that once data is entered into the database, it is not processed. Even if it\u2019s written in the SQL query format, the system will not start executing it but will place the data as it is.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2. Sanitize User Input<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure that the special syntax recognized by SQL is restricted from embedding the commands containing different data inputs. Some data that are safe to input into the JSON files may be harmful to SQL queries and SSH commands.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3. Limit Database Permissions<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Practice the principle of least privilege (POLP). When a user works on the website, for sure to do some modification, the highest-level access is required. But think twice before putting a checkmark near the \u201call privileges\u201d option that grants unlimited access. Instead, you must make sure that the person who requires the highest-level access actually needs it to perform their duties.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4. Limit the Display of Specific Errors<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">With some login screens, if a user inputs the wrong username, an error will pop up saying \u201cUser \u2018JohnDoe123\u2019 was not found.\u201d Being this specific opens the door for attackers to brute force logins. In other words, attackers can continue inputting random usernames until the banner no longer shows. To prevent this, you will need either limit the error display or turn it off completely. This ensures that only your internal users have access to the error log to be able to troubleshoot issues when they occur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In addition, it\u2019s also possible to implement<a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/SQL_Injection_Prevention_Cheat_Sheet.html\" target=\"_blank\" rel=\"noreferrer noopener\"> the procedure on SQL injections prevention<\/a> within your company, so that every time the new updates are planned, you can instruct the employees on what aspects are worth attention.<\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12653\"><\/span>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Final Thoughts on SQL Injection Attacks<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While the number of SQL injection attacks is increasing, luckily for us, detection technologies are becoming smarter, which makes such attacks easier to stop. First and foremost, before starting the development:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Make sure to outline the security requirements;<\/li><li>Initiate regular code reviews by system architects; and<\/li><li>Don&#8217;t forget to conduct security penetration testing before releasing to production.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you only make changes to SQL, the vulnerabilities of other systems hosted on the server may lead to a successful attack. So, it\u2019s necessary to take care of server-level security by:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Installing the Firewall,<\/li><li>Having anti-malware protection, and<\/li><li>Performing regular updates to the Operation System, SQL, PHP, and other components as soon as they are released.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The same goes for maintaining current software versions and different themes\/plugins, if applicable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Last but not least, use only licensed software from authorized vendors as backdoors may be included in it even at the purchase stage. Also, if you\u2019re the one who operates the service, make sure to closely follow industry news to keep an eye out for new attack methods.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Stay safe!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em><strong>This article was co-written with Kevin Kline, principal program manager at SentryOne. Kline is the founder and former president of PASS and the author of popular IT books like SQL in a Nutshell. He&#8217;s a renowned database expert, software industry veteran, Microsoft SQL Server MVP, and long-time blogger at SentryOne. You can follow Kevin on <a href=\"https:\/\/twitter.com\/kekline\">Twitter<\/a> and <a href=\"https:\/\/www.linkedin.com\/in\/kekline\/\">LinkedIn<\/a>.<\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Web-applications attacks, including SQL injection attacks, more than doubled in 2019, according to data from SonicWall Taking into account the trends for more and more businesses going online, the number&#8230;<\/p>\n","protected":false},"author":30,"featured_media":12284,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16,10200],"tags":[4330],"class_list":["post-12278","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","category-monthly-digest","tag-sql-injection","post-with-tags"],"views":21389,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/04\/sql-injection-attack.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/12278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=12278"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/12278\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/12284"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=12278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=12278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=12278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}