RSSMicrosoft gets more pro-active against SQL injection attacks
By Scott M. Fulton, III | Published June 25, 2008, 11:59 AM
Turning up the volume on its vigilance against perhaps the easiest exploit in the world, Microsoft yesterday unveiled a new beta of an overdue security tool for IIS 7, bolstered by two new SQL injection vulnerability seeker tools.
Last April, the vulnerability spotlight was turned once again on Microsoft, as it found itself answering charges that it had enabled a "wave" of SQL injection attacks on Web servers running Internet Information Services, typically in conjunction with Microsoft SQL Server. It turned out not to be a wave after all, but Microsoft turned up the heat anyway, unveiling yesterday a new set of tools for combating SQL injection problems, including the latest beta of its ISAPI query filtering tool.
UrlScan 1.0 was first released in September 2001 as Microsoft's first line of defense against potentially maliciously crafted SQL queries that, when run unchecked, can wreak havoc on a Web server's database infrastructure. Version 2.5 was unveiled last year, but it was primarily tailored for IIS 6.0.
But it's IIS 7.0 that began rolling out late last year, and is now an integral part of Windows Server 2008. That version has a radically modified communications infrastructure, now based on Windows Communication Foundation. The key system driver, http.sys, can handle Web requests very differently, so it's high time that Microsoft introduce an updated UrlScan tailored for IIS 7.
As Microsoft has continually warned from the beginning and which its developers repeated yesterday, UrlScan is not a catch-all for every possible SQL injection attack. Rather, it presents the administrator with a rich set of controls for setting the boundaries of certain features that can be invoked through a SQL query. One exploit that UrlScan has historically been effective with involves the pairing of malicious SQL queries with HTTP requests that involve the use of WebDAV, an authoring and versioning protocol originally designed as an extension to HTTP for enabling collaborative documents. It's still a useful protocol unless your Web site doesn't actually use it, in which case, UrlScan can help you filter WebDAV out. If you do use WebDAV, there are ways UrlScan can help detect typical signs of WebDAV exploits, while letting legitimate requests pass.
BETACHECK
For more:
"SQL Injection Attacks by Example" by Steve Friedl, a brilliant but straightforward essay demonstrating exactly how a typical SQL injection attack is carried out.
"Using UrlScan" -- Updated documentation from Microsoft on setting up and running the UrlScan 3.0 beta with IIS 7.0.
This Microsoft white paper on UrlScan 2.5 (still the current release version) goes into explicit detail on many of these settings, including WebDAV controls. However, it makes the point that more direct control of WebDAV functionality was added to IIS 6.
Installing UrlScan is not an instantaneous affair, and should not be done like some consumer anti-virus program. There are steps which should be undertaken in advance to prepare IIS 7 for the change, which are outlined in this documentation released yesterday.
In addition, Microsoft also released a community technology preview of a new source code analyzer that can detect elements of ASP.NET source code that may be vulnerable to SQL injection attacks. And Microsoft also announced it had teamed up with HP to develop and deliver a Web site crawling tool that examines Web pages for potential holes.
"Scrawlr will crawl a website while simultaneously analyzing the parameters of each individual Web page for SQL Injection vulnerabilities," reads a blog post from HP's security laboratory yesterday. "Scrawlr is lightning fast and uses our intelligent engine technology to dynamically craft SQL Injection attacks on the fly. It can even provide proof positive results by displaying the type of backend database in use and a list of available table names."
Guys, here is the answer to your web server problems:
http://www.apple.com/server/macosx/
Leaving your web server security up to Microsoft is the same as posting your credit card, pin # and SSN all over the internet and expecting not to be a victim of identity theft.
Again Apple leads the way. Here is what the ULTRA Windoze fanboy, Paul Thurrott had to say about Apple yesterday in comparison to Microsoft and why M$ is a ship that is quickly sinking:
http://www.winsupersite....owcase/ms_swiftboat.asp
Score: 0
|-edited- I'm not going to feed the troll he does such a wonderful job himself at promoting alternatives to apple. Also ignoring the fact that sql injections are not restricted to microsoft platforms...
P.S last time you made an absurd claim such as apple leading the way blah blah .. you forgot to back it up when several people hit you up on it.
Score: 0
|Providing a free Apple education to you miserable, misguided and seriously misinformed Windoze fanboys should be considered a daily Christmas present, not trolling.
Also before claiming I don't backup what I say, at lease bother to click the hyper links provided. The last link by your fellow hardcore M$ fanboy, Paul Thurrott, provides all of the backing up I need...
Score: 0
|How someone can honestly be so thick as you is beyond comprehension. Someone points out you have serious issues each and every single time you post nonsense and they automatically become a windows fanboy. I think you are the windows fanboy because there is no way in hell anyone who calls themselves an apple fanboy would dare post the bulls*** you have on this site. I’m surprised more apple supporter’s haven’t told you to shut-up about what you don’t know or understand. But then again there is a serious lack of them here. Fanboys have a clever way of twisting words to support their case. You twist yourself just trying to construct a post that makes sense and people would actually read and value the input.
What on earth does that link prove about the topic? Do you READ what the hell you link to? (lets not start on reading what you post) Do you even have the slightest idea about software security?
MANY times you linked to rubbish articles that only proved to people you don’t have any interpretation skills or just trying to rubbish the apple camp with stupidity. And the myspace links topped the charts.
http://www.betanews.com/...sic_retailer/1214256617
Start by clinking that link and start backing up the bulls*** that several people caught you out on.
Every time it gets too hot for you to handle you run away or respond in a way that does not in the slightest back your claims up – only shows people you cant actually.
Score: 0
|http://www.winsupersite....owcase/ms_swiftboat.asp
And what does that have to do with SQL injection? Which is what the article is about.
I am afraid you are pegged as troll with good reason. Most likely it doesn't bother you. However if you are not just another troll do try changing these behaviors that are often clear indications of a troll.
Links that are wholly and completely unrelated to the subject as above.
Calling people fanboys.
Engaging in ad hominem attacks.
Just thought I would make a few suggestions, as this is a useful site even if the articles aren't exactly examples of excellence in journalism. Cutting down a bit on the more worthless comments would at least be a start in improving the site. Might even be an example for the writers of the articles.
This one for instance made sense and didn't seem to be missing whole paragraphs that are often seem lost somewhere between keyboard and seat.
Edit
Oops had to add in one word. Can't leave out FOR when I am being snarky about people leaving out paragraphs.
Score: 0
|"Cutting down a bit on the more worthless comments would at least be a start in improving the site"
Yes I agree and have suggested in the past at the very least they should introduce a rating per post so at least the trolling wont be visible to those that just want to read.
One of the things I like about this site is that it doesnt have that *professional edge* feel to it :)
Score: 0
|If you dont know what is SQL injection then do not talk about it. Don't act stupid. I see all of your posts are promoting Apple's products and blame Microsoft. If you like Apple just stay with it and leave Windows users alone like they do to you.
SQL injection (and cross site scripting) are bugs that was created by programers as they were lazy when programing. Its can happen in everywhere, Linux, Windows, OSX, PHP, Perl, Python, Java, C#. Depend by programers.
Score: 0
|Really? MacOSX protects against SQL injection attacks? Does it break down queries against Steve's white list of allowed browsers / users / computers / locations / query results?
That sounds "super awesome"!
I need to get MacOSX.
Score: 0
|"free Apple education"
WTF, people don't want it even if it's free.
Thanks.
heh
Score: 0
|The problem you'll see with a scoring system is that all the trolls will become "raters" and they will hide valuable comments from view because they don't agree with them.
It doesn't matter if they are MacOS, Windows, or Linux trolls; they will rate down what they don't like to see.
Score: 0
|That can still be a win though, dont see any comments at all! :) I forget how *well* that system works on digg sometimes :|
But I just want to see something to see that the BN staff actually do care about the quality that follows their articles.
Score: 0
|Good point. heh
Score: 0
|Loser
Score: 0
|Its one thing to like a particular platform.
Its quite another to tout it as a solution to whatever ails you - even if you are clueless as to what the problem may be.
Enjoy your Mac, but its the unmitigated denigration of other platforms regardless of the basis that makes you just as obnoxious as the myriad knee-jerk Windows fanboys who bash the Mac simply because its an Apple product.
My I suggest that if you want to make a valid comparison (and no, TV commercials and UTube videos are not), please make them.
But until then, keep the adolescent emotional rant to yourself.
Score: 0
|Did you click the links you provided? One is the purchase page for the Mac Server OS. The other does
not link to a downfall of Windows server and the upcoming Mac server. He actually thinks the Windows Server is solid and an impressive upgrade.
Quote:
Final thoughts
This review only touches the surface of the new functionality in Windows Server 2008, highlighting but a subset of the improvements Microsoft has shipped in this release. There is a lot more to say about this impressive update, and of course my Windows IT Pro Magazine compatriots and I will do just that over the coming months. Though familiar on the surface, Windows Server 2008 enables so much new functionality, and comes with so many changes, that you will need to dedicate some time to understanding how these changes will benefit your own requirements and needs. This effort is worthwhile: Windows Server 2008 is a solid and impressive upgrade that should meet the needs of virtually any business customer. I see no serious downsides to this product at all. Highly recommended.
--Paul Thurrott
February 24, 2008
Updated February 25, 2008
Link:
http://www.winsupersite.com/reviews/win2008.asp
So please do not provide people with false information.
Score: 0
|I am a Mac user at home and Vista at work. But, please, please SHUT UP, because, you are making other Mac users look bad.
I believe you need professional help, though.
Score: 0
|WTF, I thought it was market share not ease of exploitation.
I'll be damned.
Score: 0
|You talking about virus's or software exploitation?
Score: 0
|"Last April, the vulnerability spotlight was turned once again on Microsoft, as it found itself answering charges that it had enabled a "wave" of SQL injection attacks on Web servers running Internet Information Services, typically in conjunction with Microsoft SQL Server. It turned out not to be a wave after all, but Microsoft turned up the heat anyway, unveiling yesterday a new set of tools for combating SQL injection problems, including the latest beta of its ISAPI query filtering tool."
There is no difference, any exploitable vulnerability leads to worms and viruses.
Score: 0
|I dont think you understand what I was suggesting but its ok I have no desire to start a argument over this.
Score: 0
|I'm talking about desire to attack due to ease of exploitation vs largest "media" response.
Ultimately it could be an exploit targeted by hackers, or a virus that exploits it programatically.
Does that answer your question?
Score: 0
|"Does that answer your question?"
Nope but I do understand what you are saying now, I made a incorrect assumption the first time.
It's a touchy subject :)
Score: 0
|It shouldn't be touchy, Microsoft is doing the right thing here. The result of this (provided it's used) will result in a more secure internet for everyone.
They should be properly commended for their security work over the last 5 years.
Score: 0
|"They should be properly commended for their security work over the last 5 years"
I'm a windows supporter, and even I chuckled when I read that...
properly commended does not neccessarily equal happy things.
Score: 0
|com·mend
Pronunciation Key
tr.v. com·mend·ed, com·mend·ing, com·mends
1. To represent as worthy, qualified, or desirable; recommend.
2. To express approval of; praise. See Synonyms at praise.
3. To commit to the care of another; entrust.
- http://dictionary.reference.com/browse/commended
Score: 0
|