Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

SQL injection flaws easy to find and exploit, Veracode report finds

'Everyday hackers' use search engines to hunt for holes

Article comments

The software industry’s inability to reduce the number of security flaws in its code is fuelling an age of the ‘everyday hacker’, criminals who can exploit vulnerabilities with a minimum of technical skills, Security testing firm Vercode’s latest State of Software Security (SoSS) report (reg required) has suggested.

Of the 22,430 applications submitted to the firm’s code analysis service in the three 18 months to June 2012, only 13 percent of web applications were able to pass the generic OWASP Top 10 list of security problems.

When it came to standalone applications, only 31 percent complied with the separate CWE/SANS Top 25, a significant decrease on the compliance rate in the previous SoSS report caused, Veracode suggested, by a broader sample of companies using the service.

Nevertheless, the percentage of applications containing common but serious flaws such as SQL injection remained static at 32 percent, with cross-site scripting also stubbornly entrenched at 67 percent.

In short, these failure rates underscore that weak and insecure software development lifecycles are still an issue years after the industry was supposed to have started fixing the problem. Data breaches were an inevitable consequence.

And having failed to eradicate issues such as SQL injection, the ability of non-technical hackers to hunt down and exploit them also augured badly for the industry, Veracode said.

The company predicts that around one in three data breaches during 2013 will be caused by SQL injection alone, one of the easiest for ‘everyday hackers’ to target.

“The pessimist remains very concerned that we are not seeing the dramatic decreases in exploitable coding flaws that I expect to see with each passing year,”said Veracode’s co-founder and CTO, Chris Wysopal in his introduction to the report.

“It’s as if for each customer, development team, or application that has become more secure, there are an equal number or more that do not,” he added.

“Put more bluntly, we must figure out a way to code more securely simply to keep up with attacks from the most basic attacker.”

The effect of failures in the SDL on the security professional and CISOs is open to some debate although Veracode claims that the average length of tenure could now be as low as 18 months. Is this an effect of data breaches, and therefore code insecurity? That’s not clear.


More from Techworld

More relevant IT news


Sumit Siddharth said: Learn about advanced SQL Injection technique as well other lesser known injection flaws such as LDAP HQLI XPATH XXE etc at Black Hat Las vegas 2 days hands on training httpswwwblackhatcomus-13

Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *