Apparently Barracuda (who is in the network security business) had one of their applications broken into this week as reported by CNet. While no source code was stolen from Barracuda, it still has to be embarrassing to have names and email addresses of employees, leads and partners to be downloaded all thanks to a poorly written PHP application. Passwords were also downloaded as part of the data dump, but the passwords were only stored as MD5 hashes. However MD5 isn’t considered to be very secure any more (which is one of the reasons that SQL Server “Denali” is including SHA2 which is still considered to be secure).
Apparently the website which was attacked is normally secured using a Barracuda Web Application Firewall, but it was taken offline during a maintenance window on Friday night (April 8th, 2011). On Saturday night at about 5pm a script being crawling the website looking for SQL Injection weaknesses, which is found about two hours later.
Sadly this isn’t the first SQL Injection attack to happen recently. Just a couple of weeks ago MySQL.com’s website was attacked also using SQL Injection and a large amount of information was taken from their database as well.
You can read more about the Barracuda breach on CNet or on Barracuda’s own blog.
Denny
Follow
This is very sad news. How do we secure our system from this type of attacks.
We have to discuss about this among DBA’s to get clear picture.
How can we protect our server?
Is there any way(s) the we can implement in the organization?
This is the catch with SQL Injection, as DBAs we can’t protect the databases from SQL Injection. This must be done from the application layer before the data gets to the SQL Server. By the time it gets to the SQL Server it is just to late. I talk about SQL Injection in chapter 6 of “Securing SQL Server”, there are lots of other books available on SQL Injection specifically.
Thank you Denny.
If you only allow your app to hit stored procedures, you can prevent a hacker from running ad-hoc queries through SQL injection. When the web-dev groupo says they need ad-hoc SQL queries, just say no. If you really have to give ad-hoc access, grant it only to a DMZ schema and take care what you put in there.
Hi! I am aware that is relatively away from matter but When i ended up being questioning when you recognized in which I can get yourself a captcha plugin intended for our comment form? I’m using the exact same blog software because your own property along with I’m getting issues finding just one? Cheers a lot!
There’s a variety of captcha plugins available for WordPress. Go to the Plugins > Add a plugin page, and search for Captcha. When I did this 19 plugins came up. You’ll probably want the one called Math Captcha as that’s installed of 40,000+ WordPress installations.