SQL injection attack on House of Fusion

Sorry for the problems with the House of Fusion site. We've been under massive attack by sql injection bots and I've just been able to get a handle on it. A fast solution to the problem is this: <cfif findnocase("';DECLARE", cgi.query_string)><cfabort></cfif> It works unless you have a few hundred attacks at a time. In that case, place a cfmail before the abort and send youself the cgi.remote_addr. Then block it on the webserver level. It works very well. I've blocked a dozen IPs and now the site is back to flying. -- Michael Dinowitz (http://www.linkedin.com/in/mdinowitz) President: House of Fusion (http://www.houseoffusion.com) Publisher: Fusion Authority (http://www.fusionauthority.com) Adobe Community Expert / Advanced Certified ColdFusion Professional

Yeah, I've gotten a couple today.. but fortunately when Ray built BlogCFC. he covered his bases. Scott Stewart ColdFusion Developer Office of Research Information Systems Research & Economic Development University of North Carolina at Chapel Hill Phone:(919)843-2408 Fax: (919)962-3600 Email: sastew01@email.unc.edu Michael Dinowitz wrote: ----- Excess quoted text cut - see Original Post for more -----

Covering the bases with cfqueryparam is one thing, being mobbed is another. Sometimes you have to stop these things before any other code is run. I've put that abort script at the top of all my application.cfcs jst to brute force stop the horde. On Fri, Aug 8, 2008 at 10:31 AM, Scott Stewart <sastew01@email.unc.edu>wrote: ----- Excess quoted text cut - see Original Post for more -----

and your absolutely right, I've gotten two and query params covered it, but it sounds like you're getting hit two pronged. "If the injection doesn't do something, the brute force attack will" I'm almost flattered that someone thought my site was important enough to attack... Scott Stewart ColdFusion Developer Office of Research Information Systems Research & Economic Development University of North Carolina at Chapel Hill Phone:(919)843-2408 Fax: (919)962-3600 Email: sastew01@email.unc.edu Michael Dinowitz wrote: ----- Excess quoted text cut - see Original Post for more -----

> I'm almost flattered that someone thought my site was important enough > to attack... They didn't. The attack is probably driving itself based on a Google search ( [inurl:.cfm] ?) . -- Tom Chiverton **************************************************** This email is sent for and on behalf of Halliwells LLP. Halliwells LLP is a limited liability partnership registered in England and Wales under registered number OC307980 whose registered office address is at Halliwells LLP, 3 Hardman Square, Spinningfields, Manchester, M3 3EB.  A list of members is available for inspection at the registered office. Any reference to a partner in relation to Halliwells LLP means a member of Halliwells LLP.  Regulated by The Solicitors Regulation Authority. CONFIDENTIALITY This email is intended only for the use of the addressee named above and may be confidential or legally privileged.  If you are not the addressee you must not read it and must not use any information contained in nor copy it nor inform any person other than Halliwells LLP or the addressee of its existence or contents.   If you have received this email in error please delete it and notify Halliwells LLP IT Department on 0870 365 2500. For more information about Halliwells LLP visit www.halliwells.com.

Ouch.... Thanks Tom... :) -- Scott Stewart ColdFusion Developer Office of Research Information Systems Research & Economic Development University of North Carolina at Chapel Hill Phone:(919)843-2408 Fax: (919)962-3600 Email: sastew01@email.unc.edu Tom Chiverton wrote: ----- Excess quoted text cut - see Original Post for more -----

Which explains why House of Fusion is being so heavily hit. We're literally everywhere on Google. Fusion Authority on the other hand has all of its urls masked to .htm so the only one being attacked there is an old .cfm archive. I'm working on a webserver level fix for this which will bypass the need to block based on IPs. I just need a few moments. The attacks are hitting VERY hard. I got 4000 alert emails in the space of 5 minutes before I turned them off again. On Fri, Aug 8, 2008 at 11:27 AM, Tom Chiverton <tom.chiverton@halliwells.com ----- Excess quoted text cut - see Original Post for more -----

Yep, I turned e-mail notifications off too, leave it on and you can inadvertently turn blocking SQL injection attacks into a self-imposed DoS attack. Fun stuff. On the plus side, it's nice to see CF finally getting the recognition it deserves, even if it is from parasitic bottom-feeding bots created by despicable scum-sucking feeble-excuse-for-a-carbon-based-life-form repugnant socially-inept basement-dwelling death-penalty-deserving hacker-wannabes. --- Ben Which explains why House of Fusion is being so heavily hit. We're literally everywhere on Google. Fusion Authority on the other hand has all of its urls masked to .htm so the only one being attacked there is an old .cfm archive. I'm working on a webserver level fix for this which will bypass the need to block based on IPs. I just need a few moments. The attacks are hitting VERY hard. I got 4000 alert emails in the space of 5 minutes before I turned them off again. On Fri, Aug 8, 2008 at 11:27 AM, Tom Chiverton <tom.chiverton@halliwells.com ----- Excess quoted