SQL Injection Attacks Being Used by Hackers for Profit

Published: July 26, 2006

by Alex Woodie

IT security firm SecureWorks last week reported a sharp rise in so-called "SQL Injection" attacks across the Web since April. The attacks, which involve a hacker injecting malicious code into a form connected to a database through a Web site, are originating from overseas, and are becoming increasingly successful tools for committing financial crimes, the company says.

SecureWorks CTO Jon Ramsey explains how popular SQL Injection attacks have become. "From January through March, we blocked anywhere from 100 to 200 SQL Injection attacks per day," he says. "As of April, we have seen that number jump from 1,000 to 4,000 to 8,000 per day."

SecureWorks continuously monitors the state of malware on the Web for its clients, which use its intrusion prevention system for servers and networks. "Although we certainly see a higher volume with other types of attacks, what makes the SQL Injection exploits so worrisome is that they are often indicative of a targeted attack," Ramsey says.

As opposed to a worm, which spreads indiscriminately, a SQL Injection attack by its nature is a targeted attack. The attacks can affect any type of dynamic input box for a Web form connected to any standard SQL database. An easy to way prevent such attacks is to validate the data before submitting the query, but not all Web sites take this step.

Several recent criminal attacks have utilized the SQL Injection method, including last year's CardSystems security breach, where hackers stole 263,000 customer credit card numbers and exposed 40 million more, SecureWorks says. And last December, Russian hackers broke into a Rhode Island government Web site and stole up to 53,000 credit card numbers.