Page 222 - Using MIS

Security Guide

theft by SQl injeCtion

**Warning** You are about to learn a technique for 3. One Web site received 94,057 SQL injection attack re-
compromising an information system called SQL injection. quests in one day.
Do not try it on existing systems. SQL injection attacks leave Let those numbers sink in: Your corporate Web site is likely
log entries with your IP address attached. Attempting SQL being attacked on a regular basis.
injection on a system without permission is illegal. You can
be identified, tracked, and charged. Felony hacking convic-
tions are not resume builders. How Does SQL Injection Work?
SQL injection is a popular way to steal data because it SQL injection, as it sounds, is a way of inserting your
can be done from anywhere in the world. You don’t even need own SQL code into someone else’s information system.
to physically enter the target country. You need some smart To understand this, consider what happens when you
people with time to invest and a couple modest computers. normally log in to a Web site. You enter your username
From a criminal’s point of view it’s a low-risk and high-reward
proposition.
SQL injection is a criminal at-
tack on an information system to il-
legally extract data from a database. SQL
It can add or delete data, drop tables
and their data, and even shut down
an information system. And, because
it can be done from anywhere in the
world, criminals can rob from coun-
tries that don’t extradite criminals,
such as Russia, China, North Korea,
and others.
Criminals have caught on to theft-
®
by-SQL-injection. Imperva , an en-
terprise data security firm, listed the
following key findings in its 2013 Imperva
Web Application Attack Report: 8

1. Retailers suffer two times as many
SQL injection attacks as other
industries.
2. Most Web applications receive four
or more Web attack campaigns per
month, and others are constantly
under attack (176 out of 180 days).
Source: Federico Caputo/iStock/Thinkstock

8
Imperva, “Imperva Web Application Attack Report,” July 2013, accessed May 19, 2014, www.imperva.com/docs/HII_Web_Application_Attack_
Report_Ed4.pdf.
190