From the Washington Post, April 25, 2008:
Quote... Hundreds of thousands of Web sites - including several at the United Nations
and in the U.K. government -- have been hacked recently and seeded with code that tries to
exploit security flaws in Microsoft Windows to install malicious software on visitors'
machines. Unquote...
Apparently there have been an estimated half-million attacks on different Web sites this week
alone. There seems to have been a rush to judgement in trying to point the finger of blame
at a recent Microsoft Security Advisory (951306). According to Bill Staples, Product Unit Manager for IIS, "Microsoft has investigated these reports and determined that the attacks are not related to the recent Microsoft Security Advisory (951306) or any known security issues related to IIS 6.0, ASP, ASP.Net or Microsoft SQL technologies."
These attacks are not related to said security advisory but are aimed at sites, on any platform, that are open to SQL Injection. What we are really seeing is a growth in SQL Injection over other types of attack. Although around for a long time now, this technique has been gaining in popularity among hackers over the last couple of years, and seems to be more popular now than cross-site scripting or buffer overflow exploits. I would argue that this would not be the case for ASP.NET sites if basic input validation and SQL parameters in combination with stored procedures were employed, as is the recommended practice.
At the very least, even if you are still using ASP and haven't time to convert to stored
procedures, check your input data! All input data is evil and when designing your application you should take time to consider where else that input may be coming from, such as query parameters, cookies, etc. Watch this space...
