SQL Injection Attacks Countermeasures

Introduction

Web applications basically work by getting some input/information from outside users. Using string operations, this information is later used and serialized into a textual representation and ultimately, a database-specific command is created and sent to the database for execution. The input from outside users is the basis of SQL injection attacks and can be malicious; therefore they must be monitored and controlled thoroughly. The 2002 Computer Security Institute and FBI revealed that on a yearly basis, over half of all database experience at least one security breach and an average episode results in close to $4 million in losses (C.S. Institute. Computer crime and security survey. http://www.gocsi.com/press/20020407.jhtml, 2002). As a result, input-validation vulnerabilities which are incorrect assumptions of input data must be carefully considered and monitored in order to reduce the risk of injection attacks.

Pietraszek and Berghe (2005) classify input validation vulnerabilities into the following categories.

• •

  Buffer overflow vulnerabilities are caused by incorrect assumptions on the input’s maximum size. As a result, buffer’s boundary will be overrun and an attacker will be able write to the adjacent memory space.

• •

  Integer overflow vulnerabilities are a result of insufficient assumptions on the range of the input. In this case, the result of an arithmetic operation will be larger than the memory space provided for the aforementioned variable.

• •

  Injection vulnerabilities result from invalid assumptions on the type of input provided by the users. A user can enter syntactic content in his/her input and cause the database to perform unauthorized operations.

We have presented six SQL injection prevention techniques in this chapter which will cover a wide range of SQL injection attacks. A combination of these prevention techniques may lead to a more secure and reliable database system.

A Learning-Based Approach To Detect Injection Attacks

Intrusion Detection Systems (IDS) are a common way of protection against malicious behavior and unauthorized access in regular desktop IT systems. An ID plays an important part in detecting and preventing attacks in regular desktop IT systems. Extensive research has been conducted on developing efficient and effective Intrusion Detection Systems. They can become handy when there are no prevention techniques defined for special types of attacks. In this case, intrusion detection systems can alert administrators about the attack so that appropriate measures can be taken.

In typical desktop IT, Intrusion Detection System is categorized as network based or host based IDS. Host based IDS monitors the activities on end systems such as system threads and processes. Network based IDS, on the other hand, monitors and analyzes traffic on the whole network by e.g. packet inspection to find attacks and malicious behavior (Hoppe, 2009).