SQL Injection Attack - A Threat to Database

 

Source: Avast

What is SQL Injection Attack?

The way an injection pierces through our skin reaching inside to disperse the medicine, SQLi or SQL injection pierces through the application interface surpassing the web security to query directly with the application database. This type of attack can be performed on any SQL equipped DBMS by sending malicious queries and thereby allowing hackers to view unauthorized and sensitive information of the business.

But, why is SQL Injection Attack harmful to you?

The main concerns are:

1. Confidentiality: The confidentiality of the users and their data is compromised as untrusted sources can view this information. 

2. Authentication: If usernames and passwords are retrieved using SQLi, impersonation can easily take place without correct knowledge of passwords in an insecure application. 

3. Authorization: If the database holds authorization information, it can be updated without any prior knowledge or proper protocol. 

4. Integrity: Just as the information can be retrieved, it can be changed or deleted completely. 

Oh, so have people been attacked using this technique before?

In 1998, the first article describing SQLi was published. Since then, there have been many such attacks. Some notable incidents are:

1. Turkish Government: A group of computer hackers called RedHack breached the Turkish Government files using SQLi on their website to erase the debt against government agencies.

2. 7-Eleven: The retail companies belonging to the 7-Eleven chain faced SQLi attack losing the credit card details of over 130 million consumers.

3. Yahoo!: 450,000 login credentials were stolen from Yahoo! in a union-based SQL injection attack from Yahoo! Voices.

There were some vulnerabilities found too, which were later rectified. So was the case with Tesla. Security researchers had publicized that a breach of the Tesla website was possible using SQL injection.

How does SQL Injection Attack work?

The first step is to find vulnerabilities in a website, more specifically in the user inputs within the webpage. If the webpage is using the user input directly in an SQL query, it’s a big loophole for hackers to smoothly sweep into their database system. Based on the different techniques to carry out this attack, the hacker can work out different combinations to understand the underlying database architecture and thereby query the information that otherwise shouldn’t have reached them. The content they enter as user input which allows them to steal data or harm the database otherwise is called malicious payloads. Once the malicious payload is sent, malicious SQL commands are executed in the database.

Are there different types of SQLi?

They’re mainly categorized into three categories based on how they access databases and the potential damage they can cause:

1. In-band SQLi

The same channel of communication is used to launch their attacks and to gather their results. This is very simple and efficient, so it's one of the most common types of attacks. There are two further variations of this method:

1. Error-based SQLi: Error messages are produced deliberately so that the attacker can try to guess the database schema using the information from the error messages.

2. Union-based SQLi: This is based on the UNION SQL operator, which will result in the union of multiple select statements. This will give a single HTTP response. This response may contain sensitive and privileged information.

2. Inferential (Blind) SQLi

Data payloads are sent to the server and their response and server behavior are observed. This helps to learn more about its structure. We also call this technique blind SQLi because there is no data transfer from the website database to the hacker, therefore no information is actually visible.

As they rely on response and server behavioral patterns, they’re typically slower to execute but just as harmful. Blind SQL injections are classified as follows:

1. Boolean: A SQL query that is supposed to return a result is sent to the database. The result could be true or false. Based on this, the information within the HTTP response can be modified or will stay unchanged. This will allow the hacker to understand whether the result was true or false.

2. Time-based: A SQL query that is supposed to make the database wait for a given number of seconds is sent to the database. This will return true or false results. Based on this, an HTTP response will be generated instantly or after a waiting period. The time taken for the database to respond will help the hacker understand whether the result was true or false. 

3. Out-of-band SQLi

This attack is only possible if certain features are enabled on the database server used by the web application. It’s used as an alternative to the other two SQLi techniques.

When the same channel can’t be used to launch attacks and gather information, or when a server is slow, Out-of-band SQLi can be used. This technique uses server capacity to create DNS or HTTP requests to transfer data to the hacker.

How do you prevent an SQL Injection Attack?

The main reason SQL injection is possible is that the backend is using string concatenation (where two strings are joined to one another to form one big string). This allows hackers direct access to how the queries will look like when querying from the database. A smart way would be to use parameterized queries or prepared statements.

Vulnerable code:

String query = "SELECT * FROM customers WHERE address = '"+ input + "'";

Statement statement = connection.createStatement();

ResultSet resultSet = statement.executeQuery(query);

Using prepared statement:

PreparedStatement statement = connection.prepareStatement("SELECT * FROM customers WHERE address = ?");

statement.setString(1, input);

ResultSet resultSet = statement.executeQuery();

Another way would be to prepend escape characters on all special characters in the input coming from the user in the backend. Special attention could be paid to SQL keywords, i.e. to invalidate input if it contains 2 or more SQL keywords. This will ensure that if the user has given any SQL query as a part of the input, it would be treated as a normal string and not as a query with keywords from SQL.

Given input:

Pune’ UNION (SELECT TABLE_NAME, TABLE_SCHEMA  FROM information_schema.tables);--

Formatted input:

Pune\’ UNION \(SELECT TABLE\_NAME\, TABLE\_SCHEMA  FROM information\_schema\.tables\)\;\-\-

A simple yet effective move would also be to print a standard error message saying “Sorry, we’re facing some technical difficulty. Please try again later.” instead of letting the user know the error was caused due to SQL statement.

As an added level of security, database administration rights must only be given to specific personnel. The rights given to normal users must be regulated properly to avoid any connection to the database directly via the user. This will reduce SQL queries being executed by them on the DBMS.

Hmm, should I be worried about getting attacked?

Unless you made a webpage and connected it to an SQL server without any of the prevention methods discussed above, you shouldn't be worried about directly being attacked. You may, however, be a victim of the aftereffects of this attack. To avoid being so, practice internet safety by not sharing too much personal information online to untrusted websites. Use trusted and noteworthy password managers and if you can, avoid storing your financial information and passwords online.

As a parting note, an SQL injection attack is a rather simple attack to carry out which can have huge and costly repercussions on its victim. So, exercise safe practices online and don't share personal information on shady websites.