SQL Injection Attack Hits BusinessWeek Site -- Visual Studio Magazine

SQL Injection Attack Hits BusinessWeek Site

By Jabulani Leffall
09/16/2008

Security firm Sophos disclosed on Monday that BusinessWeek magazine's Web site had been hacked. The attack targeted Microsoft's enterprise SQL Server database via insecure Web pages.

More than one hundred HTML pages in a section designed to help graduating MBA students find job postings got hit by hackers, according to the U.K.-based software security firm. The havoc was caused by the injection of malicious JavaScript code into BusinessWeek's backend database. The code is thought to have originated from servers in Russia.

"All it takes is one vulnerable page," said Graham Cluley, senior technology consultant for Sophos, in an e-mail. "Hackers use search engines all the time to get an entry way into databases. For this reason, Web applications should have the lowest possible privileges."

Cluley cited a recent Sophos report that estimated there is a daily average of about 16,200 infected Web pages shuffled into the sites of trusted brands.

SQL injection attacks have become a concern for Windows enterprise professionals this year. In April, security consultancy White Hat identified isolated cases of SQL-based Web sites injected with malicious JavaScript code. Perhaps the worst of it was seen January when a widespread barrage of SQL injection attacks occurred.

At that time, tens of thousands of Windows Servers and SQL Servers supporting enterprise workstations were affected -- not to mention several thousand Web sites with .gov and .edu domain suffixes. Many of the problems were remedied before serious damage could be done.

Sophos recommends a few best practices to avoid vulnerability to SQL injection attacks. First, tighten up security in custom application code. Next, control access privileges to the enterprise database. Also, use server logs to monitor HTTP requests and query strings.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Printable Format

comments powered by Disqus

Featured

Compare New GitHub Copilot Free Plan for Visual Studio/VS Code to Paid Plans

The free plan restricts the number of completions, chat requests and access to AI models, being suitable for occasional users and small projects.
Diving Deep into .NET MAUI

Ever since someone figured out that fiddling bits results in source code, developers have sought one codebase for all types of apps on all platforms, with Microsoft's latest attempt to further that effort being .NET MAUI.
Copilot AI Boosts Abound in New VS Code v1.96

Microsoft improved on its new "Copilot Edit" functionality in the latest release of Visual Studio Code, v1.96, its open-source based code editor that has become the most popular in the world according to many surveys.
AdaBoost Regression Using C#

Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the AdaBoost.R2 algorithm for regression problems (where the goal is to predict a single numeric value). The implementation follows the original source research paper closely, so you can use it as a guide for customization for specific scenarios.
Versioning and Documenting ASP.NET Core Services

Building an API with ASP.NET Core is only half the job. If your API is going to live more than one release cycle, you're going to need to version it. If you have other people building clients for it, you're going to need to document it.