Injection Attacks

"but most of all, samy is my hero"

That line appeared on more than a million MySpace profiles on October 4, 2005, and none of their owners typed it. Samy Kamkar, then 19, had hidden a short program in his own profile. MySpace let members decorate their pages with their own HTML and filtered out anything that looked like a script, but Kamkar wrote his in a form the filter didn't recognize. Anyone who viewed his profile in Internet Explorer, the browser most visitors used, ran the program in their own browser. It added the line to the viewer's profile, sent Kamkar a friend request, and copied itself there, so the next person to visit that profile caught it too.

In under 20 hours the program had sent Kamkar more than a million friend requests, and that evening MySpace took the whole site down to clear it out. Each visitor's browser ran it because MySpace served what one member typed as part of the page every other visitor loaded. Kamkar pleaded guilty to a felony in Los Angeles in January 2007. He was sentenced to three years of probation, community service, and restitution to MySpace, and he was barred from using the internet for personal purposes.

A youth soccer league runs its season through a registration site, league.example.org. A parent creates an account, adds each player with a birth date and any medical notes, picks a jersey size, and pays the fee. The same site has a team finder, where a parent types a player's last name to see which team the child landed on, and a team news board, where coaches and parents post notes about practices and games.

The registration site is a program that runs on the league's server, a computer that answers requests over the internet, and parents reach it through a browser. A program can also run on the user's own computer, like the spreadsheet program the league's treasurer keeps the budget in.

Each box on the registration form accepts any text at all, so the program has to check. A birth date that would make a player 40 years old, or a jersey size of "huge", should be refused with a message asking for another try.

The players' records sit in a database, organized as tables of rows. The team finder gets a child's team by sending the database a query written in SQL. Its program builds that query by pasting whatever was typed in the box between two single quote marks, as in the first query in the figure below. The quote marks tell the database where the typed name starts and stops.

Look at the second query in the figure, where a quote mark and a few more characters were typed after the name. Which players' teams will the database send back?

The typed quote mark closed the name early, so the database read the rest as part of the query: give me each row whose last name is Okafor, or where x equals x. Since x always equals x, every row qualifies, and the database sends back every player in the league. A stranger would see every child registered with the league and which team each one plays on, on a site that was built to show one family one name.

A program that builds a query to change data from typed input can be pushed the same way, so that a payment reads paid when it wasn't or a team's roster disappears.

TalkTalk, a British phone and internet company, noticed its network slowing down in October 2015 and traced it to SQL injection against three old web pages. The pages had come with the business TalkTalk bought from Tiscali in 2009, and nobody at TalkTalk was watching them. TalkTalk said it hadn't known they existed; the regulator said it should have. Through them an attacker reached a customer database and took the names, addresses, birth dates, phone numbers, and email addresses of 156,959 customers, along with bank account numbers for 15,656 of them.

Those pages had the team finder's flaw: they copied what a visitor typed into a query without checking it. A company can fix that in every page it knows about and still lose to one it has forgotten.

The same pages had been attacked the same way in July and again in September, and nobody noticed. The database software behind them was also out of date: a fix for a bug in it, one that let the attacker get past the database's own access limits, had been available for more than three and a half years. The United Kingdom's data protection regulator fined TalkTalk 400,000 pounds in 2016, a record for that regulator at the time. TalkTalk counted about 42 million pounds in costs in the first months and blamed the attack for about 95,000 lost customers. Five people were later sentenced, the longest term being four years for Daniel Kelley, who also tried to blackmail TalkTalk's chief executive.

A web page arrives as text written in HTML, which tells the browser what to show. Many pages also carry JavaScript, short programs the browser runs to make the page react, such as a form that checks a date before sending it. A script runs inside the visitor's browser, so it can read much of what the browser holds for the site, often including the cookie, a small piece of data that keeps a parent signed in, unless the site has marked it off-limits to scripts.

The news board copies each post into the page it builds, as in the bottom half of the figure. A post about water bottles shows up as a paragraph. A post that holds a script tag shows up as a script, and every browser that loads the board runs it as if the league had written it. That script could send each visitor's sign-in cookie to an adversary's server, or act as the parent from inside the page. Either way the adversary reaches parents' accounts, with their children's birth dates and medical notes, without knowing any password.

A second route needs no saved post. The league's page for a missing address prints the address back: "No page at league.example.org/...". If a script is tucked into the address, the page that comes back carries it, and the adversary's work is to get parents to open that one link. Of the two routes, which one reaches more parents?

Sending the link to every family on the league's email list looks like the wider attack, but each parent still has to open it, and many won't. A post on the board runs for every parent and coach who looks at the board, with no click at all, until someone removes it, so the saved post reaches more.

MySpace's filter removed the word javascript wherever a member typed it. Kamkar's code put the word inside a style setting and broke it across two lines, and Internet Explorer read the two pieces as one word:

java
script

Kamkar's program was a stored attack. It lived in a profile, MySpace served it to every visitor, and each visitor's profile became one more copy. It took no passwords and deleted nothing; it changed profiles and sent friend requests.