Study: Hacker Chatter Shows They Love SQL Injection Attacks
A recent study of hacker forums shows SQL injection is gaining favor as an attack vector. The company Imperva conducted a study of hacker forum discussions and concluded "SQL injection is now tied with DDoS as the most discussed topic."
Last year, the company said, DDoS was the most discussed attack vector, at 22 percent of discussion volume, while SQL injection followed at 19 percent. This year, both came in at 19 percent, indicating a relative rise in the popularity of SQL injection.
You have to take your studies and statistics with a grain of salt, though, as cloud hosting company Firehost reported at about the same time that SQL injection attacks accounted for only 12 percent of Web attacks blocked by its servers in the third quarter of 2012, with cross-site scripting attacks coming in first at 35 percent.
Regardless, SQL injection continues to be a serious problem that should get more attention from security teams and developers. For the latter, remember that Microsoft has some good resources to help you minimize security weaknesses, including:
There's lots more information out there. Most of the SQL injection attacks result from weaknesses in user input validation, which shouldn't be that hard to do properly. Hopefully these studies will continue to raise awareness among the coders writing these validations.
Share your thoughts on how to protect against SQL injection attacks by commenting here or dropping me a line.
Posted by David Ramel on 11/16/2012