The document analyzes SQL injection attacks from data collected from Akamai's platform protecting over 167,000 servers. It shows that over 59% of SQL injections were for probing and testing, while over 23% were for credential theft. The summary at the end states that malicious actors use a variety of techniques in SQL injections, including data exfiltration, privilege escalation, executing commands, infecting or corrupting data, and denial of service.

1. Cruel (SQL) Intentions - An analysis of
malicious intentions behind real world SQL
injection attacks
Ezra Caltum – Sr. Security Researcher Akamai
Mysql> SELECT title FROM talk;
Mysql> SELECT author FROM talk;

2. • The Platform
• 167,000+ Servers
• 2,300+ Locations
• 750+ Cities
• 92 Countries
• 1,227+ Networks
• The Data
• 2 trillion hits per day
• 780 million unique IPv4
addresses seen
quarterly
• 13+ trillion log lines per
day
• 260+ terabytes of
compressed daily logs
15 - 30% of all web traffic

3. Mysql> SELECT COUNT(DISTINCT
days) FROM research_data;
+-------+
| days |
+-------+
| 7 |
+-------+

4. Mysql> SELECT COUNT(DISTINCT
apps) FROM research_data;
+-------+
| apps |
+-------+
| 2000 |
+-------+

5. Mysql> SELECT COUNT(DISTINCT
injections) FROM
research_data;
+--------------+
| injections |
+--------------+
| 8,425,489 |
+--------------+

6. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage FROM research_data WHERE category =
'SQL INJECTION PROBING AND INJECTION
TESTING';
+------------+-----------------------+
|injections | percentage |
+------------+-----------------------+
| 5,021,240 | 59.59% |
+------------+-----------------------+

7. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'ENVIROMENT PROBING AND TESTING';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 1,308,681 | 15.5% | 38.42% |
+------------+------------+----------+

8. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'DATABASE CONTENT RETRIEVAL';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 129,814 | 1.5403% | 3.811054%|
+------------+-----------------------+

9. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'CREDENTIAL THEFT';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 1,950,749 | 23.14745% |57.269712%|
+------------+-----------------------+

10. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'LOGIN BYPASS';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 5,467 | 00.064871%|00.160499%|
+------------+-----------------------+

11. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'DATA FILE EXTRACTION';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 24 | 0.00028% |0.0007% |
+------------+-----------------------+

12. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'DENIAL OF SERVICE';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 326 | 0.00387% | 0.009571%|
+------------+-----------------------+

13. Mysql> SELECT COUNT(DISTINCT injections) as injections,
COUNT(DISTINCT injections)/8425489 as percentage,
COUNT(DISTINCT injections)/3406249 as norm_perc FROM
research_data WHERE category =
'DATA CORRUPTION';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 2,238 | 0.026556% | 0.065702%|
+------------+-----------------------+

14. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'DEFACEMENT AND CONTENT INJECTION';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
|8,156 | 0.096778% |0.239442% |
+------------+-----------------------+

15. Mysql> SELECT COUNT(DISTINCT injections) as
injections, COUNT(DISTINCT injections)/8425489 as
percentage, COUNT(DISTINCT injections)/3406249 as
norm_perc FROM research_data WHERE category =
'RCE';
+------------+-----------------------+
| injections | percentage | norm_perc|
+------------+-----------------------+
| 794 | 0.00942% | 0.023310%|
+------------+-----------------------+

16. Mysql> SELECT summary FROM talk
+------------+-----------------------+
| summary
+------------+-----------------------+
|Malicious actors use a variety of |
|of techniques. |
|Not only data exfiltration, but: |
|Elevate privileges, execute commands,|
|infect or corrupt data, deny service |
+------------+-----------------------+

17. DROP /**/ TABLE talk;
Twitter: @aCaltum
http://ezra.c.com.mx
http://www.stateoftheinternet.com

18. SELECT questions FROM
attendees WHERE (used_time
+ question_time) <= 15;