A SQL injection attack that has affected at least a half-million Web sites has entered a "third wave" that's more resistant than previous versions to traditional security measures, according to IBM security researchers.

Slideshow: SQL injections - What they are, how to stop them

"I've been tracking SQL injections for the last five or six years. This is some of the most intricate obfuscation I've ever seen," says David Dewey, research manager for the X-Force technology at IBM's Internet Security Systems division. (Compare security products.)

A SQL injection is an attack against a database-driven Web site in which the hacker executes unauthorized SQL commands by taking advantage of insecure code on systems connected to the Internet.

When Dewey talks about obfuscation, he's referring to hackers hiding attacks behind seemingly valid functionality. The attacks evolve as hackers change the SQL commands used to accomplish their goals, but the result is the same.

SQL injections are among the most common Web attacks, partly because a hacker needs little beyond a Web browser and knowledge of SQL queries. These most recent attacks, however, are "extremely complex" and hard to detect until it's too late, Dewey says.

Hackers are randomly targeting IP addresses throughout the world, looking for any Web site that would accept such an injection, Dewey says. Many successful, widely trusted retail Web sites are being affected. Internet surfers who navigate to infected sites are redirected to "exploitation sites" that simply look broken, with error messages and missing content. The users then are attacked with malware and added to a growing botnet, he says.

It happens so fast there’s no way to avoid it. "It's the speed of light," Dewey says. The SQL injections began on a small scale in January, he says. In April, hackers modified their commands to evade security measures, and the number of attacks went "through the roof," he adds.

Less than two weeks ago, IBM researchers found the latest version, which Dewey calls the third wave. While the new version of the attack is designed to sidestep security measures put in place for the second wave, once a Web site has been hit it's pretty obvious. "This thing does not try to be sneaky," he says. "It basically tries to obliterate all of your database records and inject its own content into all of your database records." Back-end data is destroyed, whether it be customer accounts, or something simple, like the content of a blog.

Whitepapers

• The Trend from UNIX to Linux in SAP(r) Data Centers
• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology

View more SECURITY whitepapers

Webcasts

• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports