The security community is divided about the recent arrest of a security researcher who hacked into the website for the elections division of a county in Florida. The question is whether he deserved to be arrested as a criminal hacker, or was rather doing a public service by exposing a vulnerability that gave anyone access to the credentials of the site’s administrator.

Not in question, however, is the sophistication of his attack. It’s unanimous that the SQL injection method he used to expose the credentials—the security community pronounces it both as “ess-que-el” or “sequel”—is one of the most basic and oldest tricks hackers use to get into websites and the contents of backend databases connected to those sites. Those databases can contain Social Security and credit card numbers, health records, or a host of other sensitive data, including log-in credentials for website administrators and others that can give a hacker access to other parts of a network beyond databases.

TL;DR: SQL injection attacks are the most common way that hackers gain access to websites and steal sensitive data, by exploiting vulnerabilities in web applications that interface with back-end databases.

The attacks exploit a vulnerability or vulnerabilities in web applications that communicate with backend servers where the databases are stored. SQL stands for Structured Query Language and refers to a programming language used to add data to an SQL database or retrieve or manipulate that data. SQL injection vulnerabilities are among the most common vulnerabilities around and have consistently appeared at the top of vulnerability lists for years. The computer security firm Imperva calls it the “most pernicious vulnerability in human computer history” and says that between 2005 and 2011, SQL attacks accounted for 83 percent of data breaches during that period.

Here’s how the attack works. When you visit a website, you communicate with an SQL database when you type your credentials into the log-in form, conduct a web site search or submit other kinds of data to the site.

An SQL attack occurs when hackers type SQL query code into that web form, and the web application that processes this input doesn’t properly check and validate it, thereby allowing the attacker to command the database to spill its data. Different commands get different results, and often an attacker will try variations to see what a database will spill. An attacker, for example, can send one type of SQL command to display the entire contents of a database in his or her browser, or use other commands to display parts of a database or give them the ability to add, modify or delete the contents of the database.

Take, for example, an e-commerce search form. A user can ask the site to return a list of Samsung TVs selling at a particular price. If the site has an SQL vulnerability, however, an attacker can insert a specially crafted string of code in the search box that might instead produce a list of all products in the database or, depending on the contents of the database, the email addresses and credit card numbers of anyone who purchased Samsung TVs.

An SQL attack was responsible for the 2011 hack of security firm HB Gary Federal, which allowed members of Anonymous to steal passwords for the company’s corporate email accounts and dump more than 60,000 emails online.

SQL injection was also the attack vector in the recent hack of Chinese toy company VTE, in which the personal information of some 4.8 million parents and 200,000 children were stolen from the company’s site.

And it was the method that hacker Albert Gonzalez and his cohorts used in 2007 to hack 7-Eleven, Hannaford Brothers, Heartland Payment Systems and other companies to access millions of debit and credit card numbers.

There have even been suggestions that the Mossack Fonseca—the Panamanian law firm that was the source of the recent massive Panama Papers leak—had a SQL injection vulnerability on its web site, though it’s not known if this is how the whistleblower who leaked the documents to media outlets obtained them.

Usually, if someone uncovers and exposes an SQL injection vulnerability but doesn’t actually use it to take or access data, they won’t be arrested. It’s treated like any other white hat security disclosure. But in the recent case involving David Levin, who exposed the vulnerability in the Lee County state elections’ web site in Florida, Levin took his penetration test a little far. He stole usernames and passwords as proof that he could get into the site’s database, then took information about the vulnerability to the candidate running against Lee County’s current elections supervisor. He then made a campaign video with the candidate, exposing the vulnerabilities in the site that the candidate’s political opponent oversees.

Levin now faces three felony counts of unauthorized computer access and appeared to admit his mistake on Twitter last week.

.@troyhunt is right, and I let hubris get the best of me. From now on I’m asking myself, “What Would Troy Do?” #WWTD https://t.co/oPF5gaCrR2

— David Levin (@realDavidLevin) May 9, 2016

Go Back to Top. Skip To: Start of Article.

COORDENADOR DE T.I

Descrição da Vaga

Requisitos:

Escolaridade: Formação em Sistemas de informação ou Análise e desenvolvimento de Sistemas.

Experiência: mínimo 3 anos na função.

Responsabilidades:

• Coordenar e supervisionar toda a área de Tecnologia da Informação da Instituição, garantindo o bom funcionamento dos softwares, hardwares e redes existentes, bem como envolvendo a elaboração de projetos de implantação e atualização de tecnologias da informação.

• Elaborar relatórios gerenciais de sua área/setor e encaminhá-los à diretoria;

• Estabelecer interação com os outros setores, garantindo a qualidade dos serviços prestados;

• Participar das reuniões junto às diretorias, mantenedores e demais líderes da Smolder;

• Realizar reuniões mensais com a equipe, visando a transmissão de informações e avaliação de indicadores de desempenho;

• Buscar o aperfeiçoamento constante dos processos de trabalho, instrumentos, métodos e técnicas com base em seus conhecimentos, observações e/ou análise.

OBS: Disponibilidade para trabalhar em Maracanaú.

Benefícios:

Horário de trabalho: 07h30min às 17h30min (segunda a quinta) / 07h30min as 16h30min (sexta).

PS 100% + PO + VT / Rota da empresa

Alimentação na empresa

Prêmio por assiduidade

Libercard

Convênio com faculdades.

Salário: Enviar pretensão salarial

Relacionado

Como aplicar

Candidatos dentro do perfil, enviar currículo para smolder.talentos@gmail.com.br
CURRÍCULOS FORA DO PERFIL ACIMA NÃO SERÃO AVALIADOS.

Relacionado

Job Categories: Free.
Job Salaries: Não informado.
Vaga expira em 5 days

Você deve fazer login ou criar uma conta, a fim de enviar uma vaga