Detecting malicious obfuscation in a SQL statement based on an effect and/or processed version thereof
Techniques are described herein that are capable of detecting malicious obfuscation in a SQL statement based at least in part on an effect and/or processed version of the SQL statement. In a first example, a raw version of a SQL statement is compared to a processed version of the SQL statement. A determination is made that a command in the processed version is not included in the raw version. The raw version is detected to be malicious based at least in part on the determination. In a second example, a SQL statement is bound to an event that results from execution of the SQL statement. Textual content of the SQL statement and an effect of the event are compared. The SQL statement is detected to be malicious based at least in part on the effect of the event not being indicated by the textual content.
1. A computing system comprising:
a memory that stores an operating system; and
a processing system coupled to the memory, the processing system configured to execute the operating system, the operating system configured to, when executed, perform the following:
compare a raw version of a structured query language (SQL) statement to a processed version of the SQL statement that results from parsing of the raw version of the SQL statement, wherein the raw version of the SQL statement and the processed version of the SQL statement are configured to produce a common result;
determine that a command that is comprised in the processed version of the SQL statement is obfuscated in the raw version of the SQL statement;
detect that the raw version of the SQL statement is malicious based at least on the command that is comprised in the processed version of the SQL statement being obfuscated in the raw version of the SQL statement; and
as a result of detecting that the raw version of the SQL statement is malicious, prevent execution of the SQL statement.
2. The computing system of claim 1 , wherein the raw version of the SQL statement formats a binary array that defines the SQL statement using a first format, and
wherein the processed version of the SQL statement formats the binary array using a second format that is different from the first format.
3. The computing system of claim 1 , wherein the operating system is configured to, when executed, perform the following:
determine whether the command that is comprised in the processed version of the SQL statement is comprised in a pre-defined list of commands that are known to have been used for malicious activity; and
detect that the raw version of the SQL statement is malicious further based at least on the command that is comprised in the processed version of the SQL statement being comprised in the pre-defined list of commands that are known to have been used for malicious activity.
4. The computing system of claim 1 , wherein the operating system is configured to, when executed, perform the following:
determine that the command, which is configured to connect to a website hosted by a computer that is external to the computing system, is obfuscated in the raw version of the SQL statement.
5. The computing system of claim 1 , wherein the operating system is configured to, when executed, perform the following:
determine that the command, which is configured to connect to a device having an IP address that is different from an IP address of the computing system, is obfuscated in the raw version of the SQL statement.
6. The computing system of claim 1 , wherein the operating system is configured to, when executed, perform the following:
determine that the command, which is configured to change a configuration setting of a computer, is obfuscated in the raw version of the SQL statement.
7. The computing system of claim 1 , wherein the operating system is configured to, when executed, perform the following:
determine that the command, which is configured to communicate with an operating system that executes on a computer, is obfuscated in the raw version of the SQL statement.
8. The computing system of claim 1 , wherein the operating system is configured to, when executed, perform the following:
determine that the command, which is configured to communicate with a network, is obfuscated in the raw version of the SQL statement.
9. The computing system of claim 1 , wherein the raw version of the SQL statement utilizes string concatenation in which a plurality of parts of a string, which defines at least a portion of a command, are concatenated using a concatenation operator to form the string.
10. The computing system of claim 1 , wherein the raw version of the SQL statement utilizes type casting in which a type of at least a portion of a command is changed from a first data type to a second data type that is different from the first data type.
11. A method, which is implemented by a computing system, comprising:
comparing a raw version of a structured query language (SQL) statement to a processed version of the SQL statement that results from parsing of the raw version of the SQL statement, wherein the raw version of the SQL statement and the processed version of the SQL statement are configured to produce a common result;
determining that a command that is comprised in the processed version of the SQL statement is obfuscated in the raw version of the SQL statement;
detecting that the raw version of the SQL statement is malicious based at least on the command that is comprised in the processed version of the SQL statement being obfuscated in the raw version of the SQL statement; and
as a result of detecting that the raw version of the SQL statement is malicious, execute an instruction, which prevents execution of the SQL statement.
12. The method of claim 11 , wherein a series of bits that defines the SQL statement is common among the raw version of the SQL statement and the processed version of the SQL statement; and
wherein the method further comprises:
defining the raw version of the SQL statement by interpreting the series of bits in a first manner; and
defining the processed version of the SQL statement by interpreting the series of bits in a second manner, which is different from the first manner.
13. The method of claim 12 , further comprising:
removing obfuscation of the command, which is obfuscated in the raw version of the SQL statement, to generate the processed version of the SQL statement, which causes the command to be comprised in the processed version of the SQL statement.
14. The method of claim 11 , wherein the raw version of the SQL statement formats a binary array that defines the SQL statement using a first format, and
wherein the processed version of the SQL statement formats the binary array using a second format that is different from the first format.
15. The method of claim 14 , wherein the SQL statement is written in accordance with the first format, and the SQL statement is read in accordance with the second format.
16. The method of claim 11 , further comprising:
determining whether the command that is comprised in the processed version of the SQL statement is comprised in a pre-defined list of commands that are known to have been used for malicious activity;
wherein detecting that the raw version of the SQL statement is malicious comprises:
detecting that the raw version of the SQL statement is malicious further based at least on the command that is comprised in the processed version of the SQL statement being comprised in the pre-defined list of commands that are known to have been used for malicious activity.
17. The method of claim 11 , wherein the command is configured to perform at least one of the following operations:
connect to a website hosted by a first computer that is external to the computing system;
connect to a device having an IP address that is different from an IP address of the computing system;
change a configuration setting of a second computer;
communicate with an operating system that executes on the second computer; or
communicate with a network.
18. The method of claim 11 , wherein the raw version of the SQL statement utilizes:
string concatenation in which a plurality of parts of a string, which defines at least a portion of a command, are concatenated using a concatenation operator to form the string; and
type casting in which a type of at least the portion of the command is changed from a first data type to a second data type that is different from the first data type.
19. The method of claim 11 , wherein detecting that the raw version of the SQL statement is malicious comprises:
detecting that the raw version of the SQL statement is malicious in absence of re-parsing the raw version of the SQL statement.
20. A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:
comparing a raw version of a structured query language (SQL) statement to a processed version of the SQL statement that results from parsing of the raw version of the SQL statement, wherein the raw version of the SQL statement and the processed version of the SQL statement are configured to produce a common result;
determining that a command that is comprised in the processed version of the SQL statement is obfuscated in the raw version of the SQL statement;
detecting that the raw version of the SQL statement is malicious based at least on the command that is comprised in the processed version of the SQL statement being obfuscated in the raw version of the SQL statement; and
as a result of detecting that the raw version of the SQL statement is malicious, performing a remedial operation, which comprises preventing execution of the SQL statement.