Skip to Content

The Danger in Web Database Flaws

Attacks that send database commands to the servers hosting a Web site have become a common way to compromise networks and infect visitors’ computers.
August 25, 2009

Last week, federal prosecutors indicted Albert Gonzalez, a man already charged with stealing nearly 100 million credit- and debit-card accounts from retailer TJX, for allegedly working with three other people to hack into another five companies. Gonzalez and his cohorts allegedly stole at least an additional 130 million credit- and debit-card accounts.

In each case, the initial compromise was through the victim’s Web site using a technique, known as SQL injection, that is rarely talked about outside of computer security circles.

The attack takes advantage of website components that allow user input, such as search boxes and login pages. If the Web application does not adequately check the validity of the string of characters, an attacker can enter a specially formatted string that, when processed, will be converted into a database command. Since most Web databases use the structured query language, or SQL, the attack is known as a SQL injection.

“It is a medium-level threat that the rest of the industry has ignored for so long, that the attackers have realized it’s a wide-open field,” says Dan Holden, product manager for IBM’s X-Force vulnerability research team.

Because Web developers are not typically programmers–and most programmers are not adequately taught security practices–online applications are rife with SQL injection flaws.

Big Blue has seen the number of SQL injection attacks double from the first to the second quarter of 2009. In the past few years, vulnerabilities that allow SQL injection to happen have occupied one of the top-three places in the annual list of flaws. Last year, about 20 percent of the 5,600 vulnerabilities entered into the National Vulnerability Database were related to SQL injection.

“Developers are working in high-level programming languages and they just aren’t taught to deal with vulnerabilities,” Holden says. “Bugs and vulnerabilities occur because people make mistakes, and it’s people that program applications.”

Underscoring the danger, security firm ScanSafe announced this week that it had found nearly 100,000 Web pages that had been compromised using a SQL-injection attack to include malicious code.

“It is like it has hit puberty,” Holden says. “SQL injection has started to come into its own.”

Keep Reading

Most Popular

A Roomba recorded a woman on the toilet. How did screenshots end up on Facebook?

Robot vacuum companies say your images are safe, but a sprawling global supply chain for data from our devices creates risk.

A startup says it’s begun releasing particles into the atmosphere, in an effort to tweak the climate

Make Sunsets is already attempting to earn revenue for geoengineering, a move likely to provoke widespread criticism.

10 Breakthrough Technologies 2023

Every year, we pick the 10 technologies that matter the most right now. We look for advances that will have a big impact on our lives and break down why they matter.

These exclusive satellite images show that Saudi Arabia’s sci-fi megacity is well underway

Weirdly, any recent work on The Line doesn’t show up on Google Maps. But we got the images anyway.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.