Data Driver

Blog archive

Study: Hacker Chatter Shows They Love SQL Injection Attacks

A recent study of hacker forums shows SQL injection is gaining favor as an attack vector. The company Imperva conducted a study of hacker forum discussions and concluded "SQL injection is now tied with DDoS as the most discussed topic."

Last year, the company said, DDoS was the most discussed attack vector, at 22 percent of discussion volume, while SQL injection followed at 19 percent. This year, both came in at 19 percent, indicating a relative rise in the popularity of SQL injection.

You have to take your studies and statistics with a grain of salt, though, as cloud hosting company Firehost reported at about the same time that SQL injection attacks accounted for only 12 percent of Web attacks blocked by its servers in the third quarter of 2012, with cross-site scripting attacks coming in first at 35 percent.

Regardless, SQL injection continues to be a serious problem that should get more attention from security teams and developers. For the latter, remember that Microsoft has some good resources to help you minimize security weaknesses, including:

There's lots more information out there. Most of the SQL injection attacks result from weaknesses in user input validation, which shouldn't be that hard to do properly. Hopefully these studies will continue to raise awareness among the coders writing these validations.

Share your thoughts on how to protect against SQL injection attacks by commenting here or dropping me a line.

Posted by David Ramel on 11/16/2012 at 1:15 PM


comments powered by Disqus

Featured

  • What's New in Visual Studio 2019 v16.5 Preview 2

    The second preview of Visual Studio 2019 v16.5 has arrived with improvements across the flagship IDE, including the core experience and different development areas such as C++, Python, web, mobile and so on.

  • C# Shows Strong in Tech Skills Reports

    Microsoft's C# programming language continues to show strong in tech industry skills reports, with the most recent examples coming from a skills testing company and a training company.

  • Color Shards

    Sharing Data and Splitting Components in Blazor

    ASP.NET Core Version 3.1 has at least two major changes that you'll want to take advantage of. Well, Peter thinks you will. Depending on your background, your response to one of them may be a resounding “meh.”

  • Architecture Small Graphic

    Microsoft Ships Preview SDK, Guidance for New Dual-Screen Mobile Era

    Microsoft announced a new SDK and developer guidance for dealing with the new dual-screen mobile era, ushered in by the advent of ultra-portable devices such as the Surface Duo.

  • How to Create a Machine Learning Decision Tree Classifier Using C#

    After earlier explaining how to compute disorder and split data in his exploration of machine learning decision tree classifiers, resident data scientist Dr. James McCaffrey of Microsoft Research now shows how to use the splitting and disorder code to create a working decision tree classifier.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events