[ISN] Microsoft British site hacked

From: InfoSec News (alerts@private)
Date: Sun Jul 01 2007 - 22:26:59 PDT


http://www.techworld.com/security/news/index.cfm?newsID=9336

By Jeremy Kirk
IDG news service
29 June 2007

A hacker has successfully attacked a web page within Microsoft UK 
domain, resulting in the display of a photograph of a child waving the 
flag of Saudi Arabia.

It was "unfortunate" that the site was vulnerable, said Roger Halbheer, 
chief security advisor for Microsoft in Europe, the Middle East and 
Africa.

The problem has since been fixed. However, the hack highlights how large 
software companies with technical expertise can still prove vulnerable 
to hackers.

The hacker, who posted his name as "rEmOtEr," exploited a programming 
mistake in the site by using a technique known as SQL injection to get 
unauthorised access to a database, Halbheer said. The site took SQL 
queries of a particular form, embedded in URLs (uniform resource 
locators), and passed them to a database. By embedding a query with an 
unexpected form in the requested URL, the hacker prompted the server to 
return error messages, Halbheer said.

>From those error messages, a hacker can get an idea of how the database 
is structured and refine a SQL query that the database will process as 
an instruction to insert, rather than retrieve, data. Eventually, the 
hacker found the right combination and inserted a link to an external 
website into the database.

That meant when the normal web page was called into a browser, the 
database would download data from an external link. In this case, it was 
two photos and a graphic, a screen shot of which is available on 
Zone-H.org, which tracks hacked websites.

There are two ways to avoid this style of attack. First, the database 
should not be allowed to return error messages, Halbheer said. Secondly, 
the web application should have validated the URL the hacker entered and 
rejected ones that should not be processed, he said.

If a programmer makes a mistake, "the bad guy can leverage it," Halbheer 
said.

SQL injection attacks are on the rise, overall, since valuable data is 
held within databases, said Paul Davie, founder and chief operating 
officer of Secerno, a security vendor that develops technology to 
protect databases from SQL attacks.

"I don't think Microsoft are unique in this respect and shouldn't be 
held up as particularly slipshod," Davie said. "This could have happened 
to practically anybody."


_____________________________________________________
Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com



This archive was generated by hypermail 2.1.3 : Sun Jul 01 2007 - 22:33:35 PDT