Microsoft recommends free tools to address SQL attacks

Share this article:
Microsoft on Thursday issued a security advisory addressing the recent spike in SQL injection attacks impacting legitimate — but poorly coded — websites.

The advisory recommends administrators leverage any number of free tools that identify vulnerable ASP and ASP.NET web application code.

Among the recommended solutions: HP Scrawlr from Hewlett-Packard; Microsoft's UrlScan version 3.0 beta and a newly developed Microsoft source code analysis tool.

"These SQL injection attacks do not exploit a specific software vulnerability but instead target websites that do not follow secure coding practices for accessing and manipulating data stored in a relational database," Bill Sisk, security response communications manager at Microsoft, said Tuesday in an email.  "These free tools offer detection and defense, as well as identify possible code which may be exploited by an attacker."

For more information or to learn how to download the tools, see the advisory.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.

EU conducts massive cyberattack simulation on critical networks

Conducted by the European Union Agency for Network and Information Security, the simulation launched 2,000 attacks on the networks of various critical infrastructure organizations.