News

SQL Injection Attack Hits BusinessWeek Site

Security firm Sophos disclosed on Monday that BusinessWeek magazine's Web site had been hacked. The attack targeted Microsoft's enterprise SQL Server database via insecure Web pages.

More than one hundred HTML pages in a section designed to help graduating MBA students find job postings got hit by hackers, according to the U.K.-based software security firm. The havoc was caused by the injection of malicious JavaScript code into BusinessWeek's backend database. The code is thought to have originated from servers in Russia.

"All it takes is one vulnerable page," said Graham Cluley, senior technology consultant for Sophos, in an e-mail. "Hackers use search engines all the time to get an entry way into databases. For this reason, Web applications should have the lowest possible privileges."

Cluley cited a recent Sophos report that estimated there is a daily average of about 16,200 infected Web pages shuffled into the sites of trusted brands.

SQL injection attacks have become a concern for Windows enterprise professionals this year. In April, security consultancy White Hat identified isolated cases of SQL-based Web sites injected with malicious JavaScript code. Perhaps the worst of it was seen January when a widespread barrage of SQL injection attacks occurred.

At that time, tens of thousands of Windows Servers and SQL Servers supporting enterprise workstations were affected -- not to mention several thousand Web sites with .gov and .edu domain suffixes. Many of the problems were remedied before serious damage could be done.

Sophos recommends a few best practices to avoid vulnerability to SQL injection attacks. First, tighten up security in custom application code. Next, control access privileges to the enterprise database. Also, use server logs to monitor HTTP requests and query strings.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

comments powered by Disqus

Featured

  • Creating Reactive Applications in .NET

    In modern applications, data is being retrieved in asynchronous, real-time streams, as traditional pull requests where the clients asks for data from the server are becoming a thing of the past.

  • AI for GitHub Collaboration? Maybe Not So Much

    No doubt GitHub Copilot has been a boon for developers, but AI might not be the best tool for collaboration, according to developers weighing in on a recent social media post from the GitHub team.

  • Visual Studio 2022 Getting VS Code 'Command Palette' Equivalent

    As any Visual Studio Code user knows, the editor's command palette is a powerful tool for getting things done quickly, without having to navigate through menus and dialogs. Now, we learn how an equivalent is coming for Microsoft's flagship Visual Studio IDE, invoked by the same familiar Ctrl+Shift+P keyboard shortcut.

  • .NET 9 Preview 3: 'I've Been Waiting 9 Years for This API!'

    Microsoft's third preview of .NET 9 sees a lot of minor tweaks and fixes with no earth-shaking new functionality, but little things can be important to individual developers.

  • Data Anomaly Detection Using a Neural Autoencoder with C#

    Dr. James McCaffrey of Microsoft Research tackles the process of examining a set of source data to find data items that are different in some way from the majority of the source items.

Most   Popular

Subscribe on YouTube