PREVENTING SQL

INJECTION ATTACK
Nguyen Van Cuong
Outline

Introduction
Some popular methods
A new approach
Introduction

Database: stores data (personal identity, credit card,

copyrighted material,) -> heart of website
SQL injection:
one of the most popular techniques to hack a website
exploits security weaknesses in a system
makes unexpected results
POPULAR METHODS
Amnesia

static analysis + run-time actions for Java-based applications

static analysis: model of expected queries
run-time actions: queries will be checked continuously
based on Java String Analysis
disadvantage: depends on the accuracy of static analysis
POPULAR METHODS
CANDID

short form of CANdidate evaluation for Discovering Intent

Dynamically
attacks: not only detected but also prevented automatically
mechanism: like word-prediction system in a smartphones
keyboard
problems solved by producing prepared statements
only partially works in all cases
POPULAR METHODS
WASP

short form of Web Applications Using Positive Tainting and

Syntax-Aware Evaluation
java library to transform complied code to keep track of taint
data prevented by using syntax-aware evaluation
MetaStrings library: integrated into a web application
needs a reliable external data resources
A NEW APPROACH
Table 1: Comparison of Techniques with Respect to SQL Injection Attack Types [4], [5]

Technique Tautologies Illegal/ Piggy- Union Stored Inference Alternate

Incorrect back Procedures Encodings
Queries

Amnesia ok ok ok ok fail ok ok

CANDID partial partial partial partial partial partial partial

Tainting partial partial partial partial partial partial partial

(WASP)
A NEW APPROACH

mentioned approaches:
errors can be detected only at runtime
hidden error or blocking valid queries
models: tightly fit to the applications

-> considerable human effort and significant expertise

A NEW APPROACH

New approach: Platform-level protection method

web application firewall: control and balance the flow of
information
plug-in for web server: more protection tasks, run faster
add a module to framework: solve request from clients
REFERENCES
1. William G.J. Halfond, Alessandro Orso, Panagiotis Manolios. WASP: Protecting Web
Applications Using Positive Tainting and Syntax-Aware Evaluation [online IEEE
transactions on software engineering; January/February 2008.
URL:http://ieeexplore.ieee.org.ezproxy.metropolia.fi/xpls/icp.jsp?arnumber=4359474.
Accessed 12 March 2015.

2. Sruthi Bandhakavi, Prithvi Bisht, P. Madhusudan, V. N. Venkatakrishnan. CANDID: pre-

venting sql injection attacks using dynamic candidate evaluations [online]. New York,
ACM New York; October 2007. URL:http://dl.acm.org.ezproxy.metropolia.fi/citation.cfm?
id=1315245.1315249&coll=DL&dl=ACM&CFID=636147638&CFTOKEN=79427405.
Accessed 12 March 2015.

3. William G.J. Halfond, Alessandro Orso. WASP: Preventing SQL injection attacks using
AMNESIA [online]. New York, ACM New York; May 2006.
URL:http://dl.acm.org.ezproxy.metropolia.fi/citation.cfm?
id=1134285.1134416&coll=DL&dl=ACM&CFID=636147638&CFTOKEN=79427405.
Accessed 12 March 2015.
REFERENCES
4. William G.J. Halfond, Jeremy Viegas, Alessandro Orso. A Classification of SQL
Injection Attacks and Countermeasures [online]. Atlanta, Georgia Institute of
Technology.
URL:http://www.cc.gatech.edu/fac/Alex.Orso/papers/halfond.viegas.orso.ISSSE06.
pdf. Accessed 12 March 2015.

5. Z. Lashkaripour, A. Ghaemi Bafghi. A Simple and Fast Technique for Detection and
Prevention of SQL Injection Attacks (SQLIAs) [online]. International Journal of
Security and Its Applications, Vol.7, No.5 (2013), pp.53-66.
URL:http://www.sersc.org/journals/IJSIA/vol7_no5_2013/5_2.pdf. Accessed 12
March 2015.
THANK YOU!