Cruel (SQL) Intentions
- 1. Cruel (SQL) Intentions - An analysis of malicious intentions behind real world SQL injection attacks Ezra Caltum – Sr. Security Researcher Akamai Mysql> SELECT title FROM talk; Mysql> SELECT author FROM talk;
- 2. • The Platform • 167,000+ Servers • 2,300+ Locations • 750+ Cities • 92 Countries • 1,227+ Networks • The Data • 2 trillion hits per day • 780 million unique IPv4 addresses seen quarterly • 13+ trillion log lines per day • 260+ terabytes of compressed daily logs 15 - 30% of all web traffic
- 3. Mysql> SELECT COUNT(DISTINCT days) FROM research_data; +-------+ | days | +-------+ | 7 | +-------+
- 4. Mysql> SELECT COUNT(DISTINCT apps) FROM research_data; +-------+ | apps | +-------+ | 2000 | +-------+
- 5. Mysql> SELECT COUNT(DISTINCT injections) FROM research_data; +--------------+ | injections | +--------------+ | 8,425,489 | +--------------+
- 6. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage FROM research_data WHERE category = 'SQL INJECTION PROBING AND INJECTION TESTING'; +------------+-----------------------+ |injections | percentage | +------------+-----------------------+ | 5,021,240 | 59.59% | +------------+-----------------------+
- 7. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'ENVIROMENT PROBING AND TESTING'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 1,308,681 | 15.5% | 38.42% | +------------+------------+----------+
- 8. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'DATABASE CONTENT RETRIEVAL'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 129,814 | 1.5403% | 3.811054%| +------------+-----------------------+
- 9. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'CREDENTIAL THEFT'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 1,950,749 | 23.14745% |57.269712%| +------------+-----------------------+
- 10. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'LOGIN BYPASS'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 5,467 | 00.064871%|00.160499%| +------------+-----------------------+
- 11. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'DATA FILE EXTRACTION'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 24 | 0.00028% |0.0007% | +------------+-----------------------+
- 12. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'DENIAL OF SERVICE'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 326 | 0.00387% | 0.009571%| +------------+-----------------------+
- 13. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'DATA CORRUPTION'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 2,238 | 0.026556% | 0.065702%| +------------+-----------------------+
- 14. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'DEFACEMENT AND CONTENT INJECTION'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ |8,156 | 0.096778% |0.239442% | +------------+-----------------------+
- 15. Mysql> SELECT COUNT(DISTINCT injections) as injections, COUNT(DISTINCT injections)/8425489 as percentage, COUNT(DISTINCT injections)/3406249 as norm_perc FROM research_data WHERE category = 'RCE'; +------------+-----------------------+ | injections | percentage | norm_perc| +------------+-----------------------+ | 794 | 0.00942% | 0.023310%| +------------+-----------------------+
- 16. Mysql> SELECT summary FROM talk +------------+-----------------------+ | summary +------------+-----------------------+ |Malicious actors use a variety of | |of techniques. | |Not only data exfiltration, but: | |Elevate privileges, execute commands,| |infect or corrupt data, deny service | +------------+-----------------------+
- 17. DROP /**/ TABLE talk; Twitter: @aCaltum http://ezra.c.com.mx http://www.stateoftheinternet.com
- 18. SELECT questions FROM attendees WHERE (used_time + question_time) <= 15;