SQL injection attacks are not a new type of attack. In fact, they are a fairly o
ID: 3756645 • Letter: S
Question
SQL injection attacks are not a new type of attack. In fact, they are a fairly old and well-understood attack that virtually all security practitioners are aware of and adept at protecting against. In spite of that, multiple high profile targets continue to fall prey to such simple and straightforward attacks.
What can we infer about security practices and protocols at the companies that are affected? Is security hard, or is it impossible? If we cannot defend against simplistic, known attacks, how can we be prepared to repel more sophisticated attacks?
Explanation / Answer
Yes, I agree. SQL injection is an old type of technique wherein malicious code is being "INJECTED" to the database so that it helps for access violation, hacking and other forms of vulnerabilities. Yes, it is a simple type of attack but still we fail to completely prevent from this attack.
There are many reasons behind this. Some of the main reasons are given below.
1. The first main reason is lack of validation. The user's input should be validated before sending a request to the database. Most of the companies still do not have complex data validation techniques on the first place. It is the root cause of the issue.
2. The SQL queries which is passed from user's input with the purpose of injecting malicious code into it. The SQL query is dynamic in nature. It dynamically executes it. We shouldn't allow dynamic query execution. The code should be written and wrapped in such a way that it uses prepared statements, not dynamic SQL statements.
3. We are also lagging in updating our systems. There are many vulnerabilities and new methods used to perform SQL attacks. We are lagging in updating patches.
4. Privileges : It is already known that creating administrator account with advanced privileges not recommended. The standard account should be created for administrator and privileges obtained when needed.
5. Information should be encrypted with advanced encryption algorithms. Even though, attacker gains access to database he do not have any information that can be understood.
6. Keeping complicated passwords and changing it often also would help.
We are failing to prevent SQL injection attack because of the above reasons. It is utmost difficult for us to handle sophisticated attacks in the future.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.