For as long as SQL injection has been around, it is still not old news — at least for attackers. Attackers will take whatever path they can to reach an exploit The simpler the path, the better. However, sometimes they need to use a little more elbow grease.
That’s where blind SQL injection comes in. If an attacker were a magician, this attack would be the last handkerchief out of his SQL injection sleeve.
What Is Blind SQL Injection?
The Open Web Application Security Project (OWASP) gave the following definition of blind SQL injection:
“Blind SQL (Structured Query Language) injection is a type of SQL injection attack that asks the database true or false questions and determines the answer based on the application’s response. This attack is often used when the Web application is configured to show generic error messages but has not mitigated the code that is vulnerable to SQL injection.”
This is called a blind attack because the actor can’t easily see the intended target without asking the important questions. An attacker typically uses blind SQL injection if traditional methods continually fail to glean information. Blind injection is a last resort.
Blind SQL Injection Attack Metrics
IBM Managed Security Services continuously monitors billions of events reported every year by client devices in over 100 countries. Analysis of the blind SQL injection data accumulated between Jan. 1, 2015, and Nov. 30, 2015, revealed some interesting findings.
Clearly, traditional SQL injection attempts win out over blind SQL injection attempts, but there are some months when attackers make a concerted effort against their targets to use blind SQL injection.
Mitigating Blind SQL Injection
Without investing time into testing, it’s virtually impossible to tell if your database deployment and its front-end infrastructure are vulnerable to blind SQL injections. SQL injection testing tools can help organizations identify SQL weaknesses in applications — but attackers can use those same tools to find entry points into the same applications.
Interested in the evolving cyber threat landscape? Read the latest IBM X-Force Research
Senior Threat Researcher, IBM X-Force