Database being changed/Hacked

Question

I don’t know if I can ask that question here, otherwise I can ask you to suspend the question, or warn me that I delete it.

For the second time I came across a bank that had been broken into. Almost all text fields of all tables in the database were added the following code at the end of the records:

</title>
<style>
    .ao0n {
        position: absolute;
        clip: rect(470px,auto,auto,470px);
    }
</style>
<div class="ao0n">quick <a href="http://ironpaydayloans.com">payday loans</a> with small commissions</div>
</title><style>
            .ao0n {
                position: absolute;
                clip: rect(470px,auto,auto,470px);
            }
        </style><div class="ao0n">quick <a href="http://ironpaydayloans.com">payday loans</a> with small commissions</div>
</title><style>
            .alry {
                position: absolute;
                clip: rect(410px,auto,auto,410px);
            }
        </style><div class="alry">A payday to get <a href="http://paydayloansforsure.com">fast payday cash loans</a> source you into them.</div>
</title><style>
            .alry {
                position: absolute;
                clip: rect(410px,auto,auto,410px);
            }
        </style><div class="alry">A payday to get <a href="http://paydayloansforsure.com">fast payday cash loans</a> source you into them.</div>
</title><style>
            .auj {
                position: absolute;
                clip: rect(441px,auto,auto,441px);
            }
        </style><div class="auj">A much a limited <a href="http://proofpaydayloans.com">payday loans</a> of that banks payday loan.</div>
</title><style>
            .auj {
                position: absolute;
                clip: rect(441px,auto,auto,441px);
            }
        </style><div class="auj">A much a limited <a href="http://proofpaydayloans.com">payday loans</a> of that banks payday loan.</div>

I was wondering if anyone’s been through this problem, or why it is. And how can I solve this problem.

Answer 1

Well come on!

From the comments I have a strong hunch, you are passing variables to your aspx, and this nowadays is a malignant gateway, the "hackers" simply take your variable, in your case your variable id and begin inserting arbitrary codes of select/insert/update this is called sql-Injection, an alternative is to totally abolish the GET, the other is to simply filter any unexpected input into your variables.

You need to have a greater control of your logs, all successful attempts or will not be in your logs on the http server (ISS, Apache, etc), waste a time analyzing these logs they will tell you where, which aspx was attacked and used as bridge to insert the values improperly.

Also scan your database logs, look for different IP’s that shouldn’t be accessed.

Check your firewall and ensure your database does not have external access, if necessary close communication only to the necessary and trusted ips/domains.

Answer 2

This really looks like SQL Injection Attack. The problem per se not get but dynamic SQL, which mounts the script on the fly. Sanitizing data helps but there are hacker techniques of quoting using ASCII code for example. then the best way to avoid this type of attack is to parameterize your queries.

If you really need to use dynamic SQL and you use MS Sql try searching for "parametrized Dynamic queries" (I believe other Dbms have something equivalent). (In the worst case scenario you will exchange your queries for stored procedures)

If you use parameters in your queries will prevent them from being hacked. Another thing I see that are trying to explore is JS script Injection but there is another Attack.

Edit

I found a reference in Stackoverflow (for PHP + Mysql ) not by chance parametrize is still the best solution

https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

Answer 3

Face this is an Injection you have to do a treatment before recording in the database if it will not always happen if you work with layers can handle in the controller if you do not change your method to post and do a validation in the request fields before inserting in the database.

Answer 4

Dear, Make sure there are no suspicious files in your hosting, and check the security issue of the forms. I had a similar problem with my hosting (Locaweb) and I believe that what generated this was an invasion of their servers, because there is no vulnerability found in our system.