How to protect yourself against the latest SQL injection

re: How to protect yourself against the latest SQL injection

Jonathan — Mon, 22 Dec 2008 13:16:09 GMT

How exactly are they able to execute the SQL code on your server?

re: How to protect yourself against the latest SQL injection

pbz — Sun, 21 Dec 2008 20:37:11 GMT

"I confirm that my code is doing all the checks required on the frontend. Because it's a cookie exploiting a flaw in IE, the execution of the code is totally transparent, nothing really I can do in my code. However securing the basics of SQL Server like the EXEC rights on the Master table has been successful. Paschal"

If this a new threat that can bypass all my parameterized queries I'm all ears! If that's the case a simple proof of concept would be helpful. What you're doing here, however, is securing SQL Server rather than fixing your application. Don't get me wrong, nothing wrong in securing your database, but you should fix your application first. If you can prove us that's fixed and the trojan successfully bypasses your checks please let us know with an example. Thanks.

re: How to protect yourself against the latest SQL injection

ca8msm — Sat, 20 Dec 2008 14:54:54 GMT

"Thanks for that info. Yes I am surely stupd because I don't know all the web config attributes by heart. Come on, be nice ;-) And yes if Microsoft can provide this behavior by default that will save a lot of my time Thanks anyway for the tip! - Paschal"

"I think that the new threat posed by the trojan recently is that it used a flaw in Internet Explorer to be able to expose a cookie to a request stream and execute some SQL command."

It's not really a flaw, and it's not just limited to IE. No-one apart from the caller should be able to view your cookies so if they are being sent elsewhere it's because YOU (not Microsoft) haven't locked them down successfully. Usually, a form of XSS is used to trick the page into sending the cookie elsewhere so I'd suggest reading up on that first. Here's our wiki article on the subject:

wiki.lessthandot.com/.../ASP.NET:_How_to_set_cookies_as_httponly

I really wish people would take the responsibility of securing their websites themselves rather than looking to blame the web server or the server-side language they use. They provide the tools to serve your site but it's you who needs to secure it.

How to protect yourself against the latest SQL injection - help.net

How to protect yourself against the latest SQL injection - help.net — Sat, 20 Dec 2008 14:14:09 GMT

Pingback from How to protect yourself against the latest SQL injection - help.net