Welcome!

Microsoft Cloud Authors: Janakiram MSV, Yeshim Deniz, David H Deans, Andreas Grabner, Stackify Blog

News Feed Item

FireHost Detects Surge in SQL Injection for Q3 2013 with Cross-Site Scripting Also Rising

FireHost, a provider of managed, secure cloud Infrastructure-as-a-Service (IaaS), today announced attack trends for its clients’ web applications in Q3 2013. In releasing its most recent Superfecta report on attempted cyberattacks* that target enterprise web applications, FireHost noted upticks in Cross-site Scripting (XSS) and SQL Injection activity that specifically target applications carrying sensitive information about organizations and their customers.

The results, noted the report’s authors, offer further evidence of how hackers, cybercriminals and malware developers are shifting away from a traditional focus on enterprise infrastructure attacks. Instead they are identifying and exploiting vulnerable application layer assets. Consequently, FireHost is advising executives, IT professionals and security officials to carefully assess the risks to which web application assets are being increasingly exposed, and allocate resources accordingly.

Well Documented Benefits of Cloud Architectures Also Create New Targets For Hackers

“The adoption of cloud computing, mobile applications and virtualized enterprise architectures have led to an expansion of applications that are connected to Internet resources,” explained FireHost founder and CEO Chris Drake.

Web-based applications are being used aggressively by public, private and non-profit enterprises of all sizes to support the entire spectrum of intra- and inter-organizational activities - including customer relationship management, supply chain management and human capital management. These IT strategies are broadly seen as flexible and cost-effective ways to rapidly deliver services that directly support critical business operations.

“What our latest Superfecta report clearly indicates is that this shift has not gone unnoticed by the hacker community and a whole range of bad actors who are always seeking new attack vectors,” Drake continued. “The immense volume of attempted incursions documented in this latest set of statistics show that web applications are exposed to clear-and-present danger. It is imperative that business leaders react and respond to these threats by bringing a new focus and attention to securing web application resources.”

Integrated Attacks on Web Applications Becoming More Prevalent and Automated

Over Q3 2013, FireHost blocked nearly 32 million attacks, a 32 percent increase over Q2 2013. More than half, 54 percent, were filtered by FireHost’s IPRM system, which dynamically identifies, catalogs and intercepts IP addresses that originate attacks against web applications.

Q3 presented a 77 percent increase in the number of filtered attacks over Q2 2013.

Between Q2 and Q3 2013, FireHost has detected an increase in attempted SQL Injection and Cross-Site Scripting attacks on the client servers it defends. The rise in SQL Injection in particular is a cause for concern as, typically, this attack method has been highly targeted; directed towards a few select high-net targets, being the preserve of only the most skilled hackers. The rise in this attack traffic suggests that technique is becoming commoditized and therefore poses a greater risk to any businesses with hosted resources.

The rise in hackers using SQL Injections attacks is cause for particular concern. According to Jeremiah Grossman, founder and CTO of WhiteHat Security, the hacker community is becoming particularly creative in combining and integrating CRSF, XSS and Directory Traversal attacks to inject code that is designed to penetrate databases that underpin many mission-critical, web-based applications.

“Also troubling is the trend we are seeing to automate these integrated SQL Injection attacks. This particular category of attack has been picking up steam for a while,” said Grossman. “But SQL Injection has traditionally required a significant amount of skill and talent from a programing perspective. This talent-based barrier to entry has helped to keep this form of attack in check. The emergence of automated tools will make this type of attack much more accessible to a broader segment of cybercriminals. This is prompting us to advise our clients to anticipate – and prepare for – a deluge of integrated attacks targeting web-based SQL resources.”

Rebalancing Security Measures Portfolio to Address Web Application Vulnerability

The trends documented in the latest Superfecta report from FireHost should serve as a call-to-action for business leaders, technology executives and security professionals to look at how IT budgets are allocated across organizations.

“Traditionally, we see the lion’s share of technology budget being spent on creating or obtaining applications. After that, infrastructure and hosting solutions receive the most financial attention. Investments in security and preventative measures come in last in most cases,” said Drake. “We create this report and work within the IT community to provide education and prove the case that attention needs to be paid to the application-layer threats, particularly for organizations that house regulated data such as credit cards, personally identifiable information, and healthcare records – where the fines for a breach of such information is quite costly.”

As organizations review their budgets and strategic plans for 2014, understanding the risks to which web applications are exposed will be important in order to make effective and responsible security funding decisions.

“Today, in many organizations, as much as $1 out of every $10 invested in enterprise infrastructure technology is allocated to protect network resources. Only $1 out of $100 is invested in web application security. This unbalanced approach does not reflect the newly emerging threat landscape,” said Drake.

Web Application Skillsets are Evolving Rapidly in Response to Threats

The good news, according to Drake, is that the security community is getting much better at identifying and mitigating the growing number of threats that target web applications.

“FireHost is working very closely with other leaders and innovative practitioners in the application security community to track, document and block attacks as soon as we encounter them,” he said. “It is one of the major reasons for producing the quarterly Superfecta report. By communicating all known instances of attacks to web applications, we are all able to better understand and respond to threats. This collaborative approach has helped us develop one of the most effective and Intelligent Security Models TM available in the cloud today.”

*Cyberattacks - four distinct web-application attack types that pose the most serious threat to businesses, comprising Cross-site Request Forgery, (CSRF), Cross-site Scripting (XSS), SQL Injection and Directory Traversal.

*Superfecta Definitions:

  • Cross-site Scripting (XSS) – Cross-site scripting involves the insertion of malicious code into webpages in order to manipulate website visitors. It is used by attackers for a range of reasons, from simply interfering with websites to launching phishing attacks against web users.
  • Directory Traversal – A Path Traversal attack aims to access files and directories that are stored outside the web root folder.
  • Cross-Site Request Forgery (CSRF) – CSRF is an attack that forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated.
  • SQL Injection – SQL Injection involves the entering of malicious commands into URLs and text fields on websites that happen to be vulnerable, usually in an attempt to steal the contents of databases storing valuable data such as credit card details or usernames and passwords. The attack vector has been associated with many high profile data breaches.

For more information, please visit: Q3 2013 Superfecta Report

About FireHost

FireHost offers the most secure, managed, cloud IaaS available, protecting sensitive data and brand reputations of some of the largest companies in the world. With infrastructure built for security, compliance, performance and agility, responsible businesses choose FireHost to reduce risk and improve the collection, storage and transmission of their most confidential, regulated data. FireHost’s sophisticated business continuity solutions allow customers to make proactive choices about distributing application traffic between more than 20 points of presence dispersed across five continents, all while meeting international data protection requirements.

Headquartered in Dallas, FireHost is the chosen secure cloud service provider for brands that won't compromise on the security of their payment card, healthcare and other highly sensitive data. http://www.firehost.com.

Follow FireHost on:

http://www.twitter.com/firehost

http://www.linkedin.com/company/firehost-inc.

http://www.facebook.com/FireHost

More Stories By Business Wire

Copyright © 2009 Business Wire. All rights reserved. Republication or redistribution of Business Wire content is expressly prohibited without the prior written consent of Business Wire. Business Wire shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

@ThingsExpo Stories
DX World EXPO, LLC, a Lighthouse Point, Florida-based startup trade show producer and the creator of "DXWorldEXPO® - Digital Transformation Conference & Expo" has announced its executive management team. The team is headed by Levent Selamoglu, who has been named CEO. "Now is the time for a truly global DX event, to bring together the leading minds from the technology world in a conversation about Digital Transformation," he said in making the announcement.
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Conference Guru has been named “Media Sponsor” of the 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. A valuable conference experience generates new contacts, sales leads, potential strategic partners and potential investors; helps gather competitive intelligence and even provides inspiration for new products and services. Conference Guru works with conference organizers to pass great deals to gre...
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform. In his session at @ThingsExpo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and shared the must-have mindsets for removing complexity from the develop...
In his Opening Keynote at 21st Cloud Expo, John Considine, General Manager of IBM Cloud Infrastructure, led attendees through the exciting evolution of the cloud. He looked at this major disruption from the perspective of technology, business models, and what this means for enterprises of all sizes. John Considine is General Manager of Cloud Infrastructure Services at IBM. In that role he is responsible for leading IBM’s public cloud infrastructure including strategy, development, and offering m...
"Evatronix provides design services to companies that need to integrate the IoT technology in their products but they don't necessarily have the expertise, knowledge and design team to do so," explained Adam Morawiec, VP of Business Development at Evatronix, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. In his session at @BigDataExpo, Jack Norris, Senior Vice President, Data and Applications at MapR Technologies, reviewed best practices to ...
Widespread fragmentation is stalling the growth of the IIoT and making it difficult for partners to work together. The number of software platforms, apps, hardware and connectivity standards is creating paralysis among businesses that are afraid of being locked into a solution. EdgeX Foundry is unifying the community around a common IoT edge framework and an ecosystem of interoperable components.
Large industrial manufacturing organizations are adopting the agile principles of cloud software companies. The industrial manufacturing development process has not scaled over time. Now that design CAD teams are geographically distributed, centralizing their work is key. With large multi-gigabyte projects, outdated tools have stifled industrial team agility, time-to-market milestones, and impacted P&L stakeholders.
"Akvelon is a software development company and we also provide consultancy services to folks who are looking to scale or accelerate their engineering roadmaps," explained Jeremiah Mothersell, Marketing Manager at Akvelon, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
22nd International Cloud Expo, taking place June 5-7, 2018, at the Javits Center in New York City, NY, and co-located with the 1st DXWorld Expo will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud ...
"Cloud Academy is an enterprise training platform for the cloud, specifically public clouds. We offer guided learning experiences on AWS, Azure, Google Cloud and all the surrounding methodologies and technologies that you need to know and your teams need to know in order to leverage the full benefits of the cloud," explained Alex Brower, VP of Marketing at Cloud Academy, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clar...
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
"MobiDev is a software development company and we do complex, custom software development for everybody from entrepreneurs to large enterprises," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
"There's plenty of bandwidth out there but it's never in the right place. So what Cedexis does is uses data to work out the best pathways to get data from the origin to the person who wants to get it," explained Simon Jones, Evangelist and Head of Marketing at Cedexis, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.