METHODS FOR PREVENTING SQL INJECTION IN IDENTITY AND ACCESS MANAGEMENT (IAM) SYSTEMS

Аннотация

INTRODUCTION downtime led to significant losses [1]. This topic remains highly relevant. Password and payment information leaks from databases, In June 2023, over 200 organizations faced data significant disruptions in the operation of web breaches due to security flaws discovered about applications—these are some of the consequences six weeks earlier in a popular file transfer program. of SQL injections. Even companies that prioritize This attack was triggered by an SQL injection cybersecurity, as well as their partners and clients, vulnerability in the MOVEit file transfer program fall victim to attackers. from Progress Software. Attackers gained access to files and credentials. Among the victims were A vivid example is the attack on the IT company schools in the USA, universities worldwide, and Kaseya in July 2021. On July 2, 2021, several companies such as BBC, Boots, and British managed service providers (MSPs) and their Airways. In total, 17-20 million people were clients fell victim to a ransomware attack carried affected by the breaches [2]. out by the REvil group, causing massive downtime for more than 1000 companies. Cybercriminals Therefore, the aim of this work is to examine bypassed authentication, uploaded a payload to methods for preventing SQL injections in identity the VSA server, and used SQL injection to deploy and access management (IAM) systems. malicious updates. As a result, more than 36,000 1. General Characteristics of SQL Injections service providers could not access Kaseya's SQL injection (SQLi) is one of the critical flagship VSA service for at least four days. The https://www.theamericanjournals.com/index.php/tajet 17 THE USA JOURNALS THE AMERICAN JOURNAL OF ENGINEERING AND TECHNOLOGY (ISSN – 2689-0984) VOLUME 06 ISSUE10 vulnerabilities in web security, allowing attackers differences in the application's responses. to interfere with queries that a web application - Applying logical conditions, such as OR 1=1 and sends to its database. This interference provides OR 1=2, to detect differences in the application's attackers with unauthorized access to data that is responses. usually protected. Attackers can gain access to - Using payloads designed to trigger time delays other users' information or other data accessible to during the execution of an SQL query, which helps the application. In some cases, the attacker can identify differences in response times. modify or delete data, causing long-term changes in the content or behavior of the application. - Employing out-of-band network interactions (OAST) intended to trigger interactions within the SQL injection vulnerabilities can be identified SQL query and track any resulting activities. manually through systematic testing of each entry point into the application. Some common methods Additionally, most SQL injection vulnerabilities include: can be quickly and effectively detected using automated tools such as Burp Scanner [3]. The - Introducing a single quote (') to identify errors or main consequences of an attack are reflected in other anomalies. Table 1. - Using SQL-specific syntax to assess the underlying value of the entry point and identify Table 1. Consequences of Cyberattacks Caused by SQL Injection Vulnerabilities Name Description Since SQL databases often contain sensitive information, maintaining this confidentiality is one of the main concerns related to SQL injection Confidentiality vulnerabilities. If username and password checks are based on unreliable SQL commands, an attacker can gain access to the system under someone else's account without Authentication knowing the actual password. If authorization rights information is stored in the SQL database, successful exploitation of an SQL injection vulnerability can allow an attacker to alter this Authorization information. Just as confidential data can be accessed, it can also be altered or even deleted Integrity through an SQL injection attack. https://www.theamericanjournals.com/index.php/tajet 18 THE USA JOURNALS THE AMERICAN JOURNAL OF ENGINEERING AND TECHNOLOGY (ISSN – 2689-0984) VOLUME 06 ISSUE10 Figure 1 further summarizes the types of SQL injections. Fig.1. Types of SQL Injections [5] From Figure 1, the following types of SQL 4. Blind Time-Based SQL Injections: Time-based injections are identified: SQL injection works by sending a query that causes the database to wait a specified amount of time 1. Error-Based SQL Injections: Error-based SQL before responding. The response time allows the injections allow attackers to extract information attacker to determine if the result is TRUE or about the database structure through error FALSE. Depending on the result, the HTTP messages generated by the database server. In response will either be delayed or returned certain situations, using this method alone, an immediately. Even if no data is returned, the attacker can gain access to the entire database attacker can determine the truth of the query. structure. However,