SQL Injection Attack Hits BusinessWeek Site
Security firm Sophos disclosed on Monday
magazine's Web site had been hacked. The attack targeted Microsoft's enterprise SQL Server database via insecure Web pages.
"All it takes is one vulnerable page," said Graham Cluley, senior technology consultant for Sophos, in an e-mail. "Hackers use search engines all the time to get an entry way into databases. For this reason, Web applications should have the lowest possible privileges."
Cluley cited a recent Sophos report that estimated there is a daily average of about 16,200 infected Web pages shuffled into the sites of trusted brands.
At that time, tens of thousands of Windows Servers and SQL Servers supporting enterprise workstations were affected -- not to mention several thousand Web sites with .gov and .edu domain suffixes. Many of the problems were remedied before serious damage could be done.
Sophos recommends a few best practices to avoid vulnerability to SQL injection attacks. First, tighten up security in custom application code. Next, control access privileges to the enterprise database. Also, use server logs to monitor HTTP requests and query strings.
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.