Cruel (SQL) Intentions

Cruel (SQL) Intentions - An analysis of malicious intentions behind real world SQL injection attacks

Ezra Caltum – Sr. Security Researcher Akamai

Mysql> SELECT title FROM talk;

Mysql> SELECT author FROM talk;

• The Platform• 167,000+ Servers• 2,300+ Locations• 750+ Cities• 92 Countries• 1,227+ Networks

• The Data• 2 trillion hits per day• 780 million unique IPv4

addresses seen quarterly

• 13+ trillion log lines per day

• 260+ terabytes of compressed daily logs

15 - 30% of all web traffic

Mysql> SELECT COUNT(DISTINCT days) FROM research_data;

+-------+| days |+-------+| 7 |+-------+

Mysql> SELECT COUNT(DISTINCT apps) FROM research_data;

+-------+| apps |+-------+| 2000 |+-------+

Mysql> SELECT COUNT(DISTINCT injections) FROM research_data;

+--------------+| injections |+--------------+| 8,425,489 |+--------------+

Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage FROM research_data WHERE category =

'SQL INJECTION PROBING AND INJECTION TESTING';

+------------+-----------------------+|injections | percentage |+------------+-----------------------+| 5,021,240 | 59.59% |+------------+-----------------------+

Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category =

'ENVIROMENT PROBING AND TESTING';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 1,308,681 | 15.5% | 38.42% |

+------------+------------+----------+


'DATABASE CONTENT RETRIEVAL';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 129,814 | 1.5403% | 3.811054%|+------------+-----------------------+


'CREDENTIAL THEFT';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 1,950,749 | 23.14745% |57.269712%|+------------+-----------------------+


'LOGIN BYPASS';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 5,467 | 00.064871%|00.160499%|+------------+-----------------------+


'DATA FILE EXTRACTION';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 24 | 0.00028% |0.0007% |+------------+-----------------------+


'DENIAL OF SERVICE';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 326 | 0.00387% | 0.009571%|+------------+-----------------------+


'DATA CORRUPTION';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 2,238 | 0.026556% | 0.065702%|+------------+-----------------------+


'DEFACEMENT AND CONTENT INJECTION';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+|8,156 | 0.096778% |0.239442% |+------------+-----------------------+


'RCE';

+------------+-----------------------+| injections | percentage | norm_perc|+------------+-----------------------+| 794 | 0.00942% | 0.023310%|+------------+-----------------------+

Mysql> SELECT summary FROM talk

+------------+-----------------------+| summary+------------+-----------------------+|Malicious actors use a variety of ||of techniques. ||Not only data exfiltration, but: ||Elevate privileges, execute commands,||infect or corrupt data, deny service | +------------+-----------------------+

DROP /**/ TABLE talk;

Twitter: @aCaltumhttp://ezra.c.com.mx

http://www.stateoftheinternet.com

http://ezra.c.com.mx/

http://ezra.c.com.mx/

http://www.stateoftheinternet.com/

SELECT questions FROM attendees WHERE (used_time +

question_time) <= 15;

Technology

Cruel (SQL) Intentions