Rechercher
Contactez-nous Suivez-nous sur Twitter En francais English Language
 

Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN

Vulnérabilités

Unsubscribe

Imperva attributes Guardian site hack to application level weaknesses

October 2009 by Imperva

The old security chestnut of SQL injection weaknesses may well be the cause for the weekend high-profile hacking of the Guardian Jobs Web site, says Imperva, the data security specialist.

Amichai Shulman, Imperva’s chief technology officer, said that the most eye-catching feature of the site hack is the use of the phrase `sophisticated and deliberate attack.’

"Our experience shows that `sophisticated attack’ is usually a pseudonym for `SQL Injection’, although I must admit that an initial glimpse into the site hints that it may actually be a more
sophisticated hack than the usual," he said.

"At the end of the day, however, I don’t think that it’s much more than SQL Injection, sophisticated or otherwise," he added.

"If it were a Trojan based attack (as happened in the TJX site hack - http://preview.tinyurl.com/ywdxf7) then they would have stated it by now and used a different wording like `hackers who managed to break into the Guardian network.’"

According to Shulman, if, as seems likely, an SQL injection attack was to blame for the Guardian site hack, then tagging it as `sophisticated’ might be a bit misleading, though not uncommon.

Organisations, he explained, have a tendency in such attacks to attach superlatives to the attack techniques used in a compromise in order to diminish from their responsibility.

"The only positive thing one can say is that the Guardian is not itself to blame, as the BBC news report on the incident refer to a third party company supplying the service. This is small comfort to
site users, however, who will now be worried about identity theft issues," he added.


See previous articles

    

See next articles


Your podcast Here

New, you can have your Podcast here. Contact us for more information ask:
Marc Brami
Phone: +33 1 40 92 05 55
Mail: ipsimp@free.fr

All new podcasts