Problem getting hacked with this new SQL injection Tool. Adword71 and direct84

[Lance Wynn]

One of my server has been compromised from this virus, and I can't seem to
block it out! I have shut down the infected server, but I need to figure
out how to check for this, and stop it.

The site is running iis5 on Windows2000, the backend DB is SQLServer 2000

Can anyone point me to some good resources for this? This is urgent!

Thanks alot
Lance
--
Support Fairtax Legislation
www.fairtax.org

"A government big enough to give you everything you want, is strong enough
to take everything you have."
-Thomas Jefferson

[Aaron Bertrand [SQL Server MVP]]

Well, do your ASP pages use ad hoc SQL? Do you validate input? Are you
using an over-privileged account to connect to the database from ASP? You
should read up on SQL injection, and determine what you are doing now that
allows it, and fix it.

I don't think anyone has given explicit instructions on how to check for it
and stop it, because there aren't enough details available about the actual
exploit. But most of the articles talk about SQL injection, so that is a
pretty good place to start.

"Lance Wynn" <La********@com munity.nospamwr ote in message
news:%2******** ********@TK2MSF TNGP05.phx.gbl. ..

One of my server has been compromised from this virus, and I can't seem to
block it out! I have shut down the infected server, but I need to figure
out how to check for this, and stop it.

The site is running iis5 on Windows2000, the backend DB is SQLServer 2000

Can anyone point me to some good resources for this? This is urgent!

Thanks alot
Lance

[Lance Wynn]

Hi, thanks for responding so quickly, there are adhoc queries, and I do
validate input. I must just be missing something... I watched the logs last
night, and saw many failed attempts come in, and then this morning, it found
a way in, and I'm not sure how...
Lance
--
Support Fairtax Legislation
www.fairtax.org

"A government big enough to give you everything you want, is strong enough
to take everything you have."
-Thomas Jefferson

"Aaron Bertrand [SQL Server MVP]" <te*****@dnartr eb.noraawrote in message
news:u6******** ******@TK2MSFTN GP02.phx.gbl...

Well, do your ASP pages use ad hoc SQL? Do you validate input? Are you
using an over-privileged account to connect to the database from ASP? You
should read up on SQL injection, and determine what you are doing now that
allows it, and fix it.

I don't think anyone has given explicit instructions on how to check for
it and stop it, because there aren't enough details available about the
actual exploit. But most of the articles talk about SQL injection, so
that is a pretty good place to start.

"Lance Wynn" <La********@com munity.nospamwr ote in message
news:%2******** ********@TK2MSF TNGP05.phx.gbl. ..

>One of my server has been compromised from this virus, and I can't seem
to block it out! I have shut down the infected server, but I need to
figure out how to check for this, and stop it.

The site is running iis5 on Windows2000, the backend DB is SQLServer 2000

Can anyone point me to some good resources for this? This is urgent!

Thanks alot
Lance

[Bob Barrows [MVP]]

Lance Wynn wrote:

One of my server has been compromised from this virus, and I can't
seem to block it out! I have shut down the infected server, but I
need to figure out how to check for this, and stop it.

The site is running iis5 on Windows2000, the backend DB is SQLServer
2000

Can anyone point me to some good resources for this? This is urgent!

Thanks alot
Lance

The simplest, and most effective, way to stop sql injection is to stop
using dynamic (ad hoc0 sql ... anywhere. Use parameters instead. For
situations where dynamic sql must be used (for example, where object
names - columns, tables, etc. - need to be dynamic), then you need to
validate all user input that will be going into that sql statement. Do
not allow any string that has not been validated to be concatenated with
another string to form a sql statement. Here are some of my canned
replies on the subject:

http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
http://www.nextgenss.com/papers/adva..._injection.pdf
http://www.nextgenss.com/papers/more..._injection.pdf
http://www.spidynamics.com/papers/SQ...WhitePaper.pdf

See here for a better, more secure way to execute your queries by using
parameter markers (tokens):
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures, or saved parameter queries
as they are known in Access:

Access:
http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

http://groups.google.com/groups?hl=e...tngp13.phx.gbl

SQL Server:
http://groups.google.com/group/micro...09dc1701?hl=en
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[Dave Anderson]

"Lance Wynn" wrote:

Hi, thanks for responding so quickly, there are adhoc queries,
and I do validate input. I must just be missing something... I
watched the logs last night, and saw many failed attempts come
in, and then this morning, it found a way in, and I'm not sure
how...

You say you validate, but does that include your free-text [Search] fields?
If not, this is a possible point of vulnerability. Here's one common avenue:

Your form includes this field:
<input type="text" name="SearchTer m" />

Your ASP script assembles a SQL statement using that submitted value:

MySQLSearchStri ng = "SELECT ... WHERE Description LIKE '%" +
Request.Form("S earchTerm").Ite m + "%'"
RS = CN.Execute(MySQ LSearchString)

You have a vulnerability if your connection uses credentials with INSERT or
UPDATE privileges in the database. The user submits input values that turn
MySQLSearchStri ng into a series of SQL statements, rather than just one
SELECT.

This is made easier for him if you send detailed error messages, since those
messages tell him what he is guessing wrong about your database, and as the
messages change, they also tell him what he is guessing correctly.

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Lance Wynn]

Thanks all, I typically do use parameterized queries, especially in.NET, but
This is a pretty old asp app (over 10 years) I think or close to it. I have
found a couple queries that look something like this:

"Select Fieldlist from table where id=" & ID

I am almost positive these are the holes. As a short term fix, will the
following work?

Select FieldList from table where id='" & replace(ID,"'", "''") & "'"

This seems pretty straight foward as it will escape any single quotes in the
variable, and place two outside to catch the rest, or is there still a hole
in there?

thanks
Lance
--
Support Fairtax Legislation
www.fairtax.org

"A government big enough to give you everything you want, is strong enough
to take everything you have."
-Thomas Jefferson

"Bob Barrows [MVP]" <re******@NOyah oo.SPAMcomwrote in message
news:OA******** ******@TK2MSFTN GP06.phx.gbl...

Lance Wynn wrote:

>One of my server has been compromised from this virus, and I can't
seem to block it out! I have shut down the infected server, but I
need to figure out how to check for this, and stop it.

The site is running iis5 on Windows2000, the backend DB is SQLServer
2000

Can anyone point me to some good resources for this? This is urgent!

Thanks alot
Lance

The simplest, and most effective, way to stop sql injection is to stop
using dynamic (ad hoc0 sql ... anywhere. Use parameters instead. For
situations where dynamic sql must be used (for example, where object
names - columns, tables, etc. - need to be dynamic), then you need to
validate all user input that will be going into that sql statement. Do
not allow any string that has not been validated to be concatenated with
another string to form a sql statement. Here are some of my canned
replies on the subject:

http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
http://www.nextgenss.com/papers/adva..._injection.pdf
http://www.nextgenss.com/papers/more..._injection.pdf
http://www.spidynamics.com/papers/SQ...WhitePaper.pdf

See here for a better, more secure way to execute your queries by using
parameter markers (tokens):
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures, or saved parameter queries
as they are known in Access:

Access:
http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

http://groups.google.com/groups?hl=e...tngp13.phx.gbl

SQL Server:
http://groups.google.com/group/micro...09dc1701?hl=en
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[Dave Anderson]

"Lance Wynn" wrote:

I am almost positive these are the holes. As a short term fix, will the
following work?

Select FieldList from table where id='" & replace(ID,"'", "''") & "'"

This seems pretty straight foward as it will escape any single quotes in
the variable, and place two outside to catch the rest, or is there still a
hole in there?

The most recent round of SQL injection attacks typically did not involve
quotes[1], so adding them will help. But in the absence of using parameters,
why are you continuing to use credentials with INSERT/UPDATE privileges?

[1] There are no quotes in this querystring:
id=1234;DECLARE %20@S%20NVARCHA R(4000);SET%20@ S=CAST(0x4400.. .7200%20AS%20NV ARCHAR(4000));E XEC(@S);

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Aaron Bertrand [SQL Server MVP]]

[1] There are no quotes in this querystring:

id=1234;DECLARE %20@S%20NVARCHA R(4000);SET%20@ S=CAST(0x4400.. .7200%20AS%20NV ARCHAR(4000));E XEC(@S);

I agree with your other points (less privileges, use parameters, etc.). But
if the "id" value is passed into a statement like:

sql = "SELECT * FROM table WHERE id = '" &
REPLACE(Request .QueryString("i d"), "'", "''") & "';"

I don't see how the querystring above could be executed, since you don't
have a way of terminating the SELECT and starting a new statement. Now, if
the expected value was numeric, I agree, this exploit is possible... unless
you first try to convert the querystring value to a numeric.

So, in the case of strings/dates, preventing string termination is a good
first step (since it is not easy to change large web apps to stored
procedures / parameterized statements at the snap of your fingers). And
likewise, ensuring that you can convert an incoming value to the expected
type before blindly passing it to statements.

But in the long run, definitely, stop using sa / dbo, use parameterized
statements, and validate input.

[Bob Barrows [MVP]]

Lance Wynn wrote:

Thanks all, I typically do use parameterized queries, especially
in.NET, but This is a pretty old asp app (over 10 years) I think or
close to it. I have found a couple queries that look something like
this:

"Select Fieldlist from table where id=" & ID

I am almost positive these are the holes. As a short term fix, will
the following work?

Select FieldList from table where id='" & replace(ID,"'", "''") & "'"

This seems pretty straight foward as it will escape any single quotes
in the variable, and place two outside to catch the rest, or is there
still a hole in there?

This will stop most ordinary hackers, but more complicated explots are
available to determined, experienced hackers, especially if you fail to
trap errors or continue to return over-informative error messages.

--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[=?Utf-8?B?cGxhbmdl?=]

This happened to me too, and it's some new SQL injection -- see
http://cyberinsecure.com/phishing-bo...und-in-google/

"Lance Wynn" wrote:

One of my server has been compromised from this virus, and I can't seem to
block it out! I have shut down the infected server, but I need to figure
out how to check for this, and stop it.

The site is running iis5 on Windows2000, the backend DB is SQLServer 2000

Can anyone point me to some good resources for this? This is urgent!

Thanks alot
Lance
--
Support Fairtax Legislation
www.fairtax.org

"A government big enough to give you everything you want, is strong enough
to take everything you have."
-Thomas Jefferson