[nsp-sec] Questions about Prevention, Detection and Education surrounding the ASP SQL injections
Lawrence Baldwin
baldwinl at mynetwatchman.com
Thu May 29 14:19:09 EDT 2008
Puck stripped it.
Here's a link:
http://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt
Lawrence.
-----Original Message-----
From: Nicholas Ianelli [mailto:ni at cert.org]
Sent: Thursday, May 29, 2008 10:11
To: Lawrence Baldwin
Subject: Re: [nsp-sec] Questions about Prevention, Detection and Education
surrounding the ASP SQL injections
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
There isn't anything actually attached or inline within this email.
Nick
Lawrence Baldwin wrote:
> ----------- nsp-security Confidential --------
>
>
>
> ----------------------------------------------------------------------
> --
>
> Attached is the document that I found most helpful in getting my SQL
> Injection knowledge somewhat improved....probably raising me from a 2
> to a 5 ;(
>
> It appears to outline the exact "playbook" that the miscreants I am
> investigating took their techniques from.
>
> Note: I am NOT investigating the IFRAME injectors, but rather the
> miscreants using SQL inject to accomplish many of the high-profile
> data breaches of 2008.
>
> The sad part is that this document is from 2005 so it can hardly be
> classified as 'adavanced' any more...despite this it appears to still
> provide effective means to inject, even against realitively
> high-profile entities.
>
> Regards,
>
> Lawrence.
>
>
> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net
> [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of Zot
> O'Connor
> Sent: Wednesday, May 28, 2008 19:16
> To: nsp-security at puck.nether.net
> Subject: Re: [nsp-sec] Questions about Prevention, Detection and
> Education surrounding the ASP SQL injections
>
> ----------- nsp-security Confidential --------
>
> We've gotten a few responses, and they are helping target documents.
> Of course I want many more ;) And some folks have asked, I will keep
> any and all information shared confidential. I prefer having
> sanitized data to share with folk, but even compiling responses is very
helpful.
>
> We have recently gotten some info, which we think is wrong, that the
> SQL attacks are putting malware on the attacked system (vs. inserting
> IFRAMEs in the DB to another server, which may or may not be
> attacked). Has any seen this?
>
> Thanks!
>
>
> Zot O'Connor
> MSRC Ecosystem Strategy Team
> Partner Outreach
> (425) 722-7575
>
>
> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net
> [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of Zot
> O'Connor
> Sent: Wednesday, May 28, 2008 12:08 AM
> To: nsp-security at puck.nether.net
> Subject: [nsp-sec] Questions about Prevention, Detection and Education
> surrounding the ASP SQL injections
>
> ----------- nsp-security Confidential --------
>
> Howdy!
>
> We are currently working on providing guidance to customers who are
> dealing with the SQL injections that are attacking ASP pages.
>
> As you are probably already aware, the injections do not attack via a
> vulnerability, but attack via weaknesses in configurations and
> software running on the servers.
>
> We are trying to compile a list of suggestions, ideas, tools, and
> experiences for dealing with the SQL injections.
>
> If you could please take a few moments and answer the following
> questions, it would greatly help us, and our mutual customers. Even
> if you have not dealt with the attacks, if you have prior experience
> or thoughts on this, it could greatly assist us.
>
> The following outline reflects our thoughts. We are looking for ideas
> on Detection, Prevention, Education, and future requests.
>
>
> 1. Detection
>
> a. Have you detected attacks?
>
> i. Was
> the attack successful?
>
> ii. What
> was the impact?
>
> iii. What
> was the cause of the weakness?
>
> 1. Was is home grown configurations or software?
>
> 2. Was it part of a package or SOP?
>
> b. How are you doing detections?
>
> i. Are
> you watching logs?
>
> ii. Are
> you monitoring your web sites?
>
> iii. Are
> you using search engines?
>
> iv. Are
you
> looking at incoming or outgoing requests?
>
> c. Did you have packet traces or logs you can share?
>
> d. Tools
>
> i.
Which
> tools are effective?
>
> ii.
Which
> are ineffective (that you might think would have worked).
>
> 2. Prevention
>
> a. Have you deployed defenses for the attacks?
>
> i. Are
> you using any tools?
>
> 1. Filters
>
> 2. Firewalls/IPS
>
> 3. Host based programs
>
> 4. Do you scan for weak systems?
>
> 5. Do you scan for weak code?
>
> ii.
> Configuration Changes
>
> iii. What
> do you use for guidance for going this?
>
> b. Did previously deployed defenses help you?
>
> c. Have any SOPs helped?
>
> 3. Education
>
> a. Are customers aware of the problem?
>
> b. Are they taking action?
>
> c. Are they successful in detection or prevention?
>
> d. Where are they going for their information?
>
> e. What information helps them the most
>
> 4. Requests for Microsoft
>
> a. Are there specific tools or features you think Microsoft could
> create or change that would help?
>
> b. What form of advice would help your customers?
>
> Thanks for your time!
>
> Zot O'Connor
> MSRC Ecosystem Strategy Team
> Partner Outreach
> (425) 722-7575
>
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the
> nsp-security community. Confidentiality is essential for effective
> Internet security counter-measures.
> _______________________________________________
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the
> nsp-security community. Confidentiality is essential for effective
> Internet security counter-measures.
> _______________________________________________
>
>
> ----------------------------------------------------------------------
> --
>
>
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the
> nsp-security community. Confidentiality is essential for effective
Internet security counter-measures.
> _______________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
iD8DBQFIPrlhi10dJIBjZIARCEIGAKCNOiTXaGq74bPQIdFFy6q+6SCPhwCg7Kk4
j0xWutcRbknotEb9FBCZlk4=
=LpkV
-----END PGP SIGNATURE-----
More information about the nsp-security
mailing list