Experts rebuke programmers who use SQL injection as feature
Programmers who aren't security savvy are coding SQL injection as a feature in some Web applications, putting users at risk when an application goes live or is distributed to affiliates of online advertising networks.
The coding is critical to the way the application runs. The problem is so pervasive that some security vendors, including TippingPoint, ship their intrusion prevention systems (IPS) with SQL injection protection filters disabled by default to avoid breaking applications.
Rohit Dhamankar, director of security research at TippingPoint's DVLabs, said the company's global IPS honeypots have detected spikes in SQL injection attacks taking advantage of the SQL injection features coded in some Web applications. TippingPoint keeps track of global threats by capturing attack attempts in its IPS filters. It also anonymously tracks how customers configure their IPS.
