Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 SQL Server Administration (2005)
 Got hacked the other day.

Author  Topic 

EvanWasHere
Starting Member

2 Posts

Posted - 2009-01-22 : 15:54:03
My developer missed this section when he cleaned it off yesterday. It’s still on my Star Sapphire categories. When you click any of the items, the page tried to reload ten other pages (I think it’s the image that are trying to load that are doing it). Looks like a SQL Injection hack.

http://www.thenaturalsapphirecompany.com/Sapphires/Star/ (clicking it won’t infect your machine.. will just try and bring u to a random search page)


I blocked the IP subnet of the hacker that did this (from China of course.. we don’t have Chinese customers, so I am totally willing to block all of China anyways from our site).

I thought the security on the firewall of restricting the IPs of our office and developers to be the one ones to access ports like SQL, RD, FTP, etc would be enough.

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2009-01-22 : 16:06:34
The firewall isn't configured correctly then.

The developer needs to start using parameterized queries in the application to prevent SQL injections.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

EvanWasHere
Starting Member

2 Posts

Posted - 2009-01-23 : 11:04:23
Yup. That was never put in. Thanks so much. Screaming at my dev now.
Go to Top of Page
   

- Advertisement -