From: InfoSec News (alertsinfosecnews.org)
Date: Mon Jul 02 2007 - 00:26:59 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.techworld.com/security/news/index.cfm?newsID=9336

By Jeremy Kirk
IDG news service
29 June 2007

A hacker has successfully attacked a web page within Microsoft UK
domain, resulting in the display of a photograph of a child waving the
flag of Saudi Arabia.

It was "unfortunate" that the site was vulnerable, said Roger Halbheer,
chief security advisor for Microsoft in Europe, the Middle East and
Africa.

The problem has since been fixed. However, the hack highlights how large
software companies with technical expertise can still prove vulnerable
to hackers.

The hacker, who posted his name as "rEmOtEr," exploited a programming
mistake in the site by using a technique known as SQL injection to get
unauthorised access to a database, Halbheer said. The site took SQL
queries of a particular form, embedded in URLs (uniform resource
locators), and passed them to a database. By embedding a query with an
unexpected form in the requested URL, the hacker prompted the server to
return error messages, Halbheer said.

>From those error messages, a hacker can get an idea of how the database
is structured and refine a SQL query that the database will process as
an instruction to insert, rather than retrieve, data. Eventually, the
hacker found the right combination and inserted a link to an external
website into the database.

That meant when the normal web page was called into a browser, the
database would download data from an external link. In this case, it was
two photos and a graphic, a screen shot of which is available on
Zone-H.org, which tracks hacked websites.

There are two ways to avoid this style of attack. First, the database
should not be allowed to return error messages, Halbheer said. Secondly,
the web application should have validated the URL the hacker entered and
rejected ones that should not be processed, he said.

If a programmer makes a mistake, "the bad guy can leverage it," Halbheer
said.

SQL injection attacks are on the rise, overall, since valuable data is
held within databases, said Paul Davie, founder and chief operating
officer of Secerno, a security vendor that develops technology to
protect databases from SQL attacks.

"I don't think Microsoft are unique in this respect and shouldn't be
held up as particularly slipshod," Davie said. "This could have happened
to practically anybody."

_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas,
the world's premier technical event for ICT security
experts. Featuring 30 hands-on training courses and
90 Briefings presentations with lots of new content
and new tools. Network with 4,000 delegates from
70 nations. Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on
June 1 so register today. http://www.blackhat.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]