SQL infections through RFID

Abstract

Automatic identification and collection (AIDC) technologies have made the life of a man much easier on numerous platforms. Of the various such technologies the radio frequency identification devices (RFID) have become pervasive essentially because they can track from a greater physical distance than the rest. The back end that supports these RFID systems has always been working well until they encounter a sbadly-formatted RFID tag. There have hardly been any incidents where such tags, once identified by the back-end systems, can in fact wreak havoc via the interacting databases in the RFID infrastructure. Recently, there has been significant research in this area. In the previous work, the author managed to do an attack using a self-referential query on Linux, Oracle, and PHP. However, they have been unable to test it on SQL Server 2005. This paper differs from the previous work in the way that it extends the attack using a self-referential query to Windows, SQL Server 2005, and ASP with their respective latest updates installed. The query itself is more robust by making certain that the table can contain it.

Development and Application of Economic Management Information System of Enterprises Based on VC++ Technology

“…Microsoft Visual C++ programming system can automatically generate the procedural framework, with first-class management flexibility. [1] This system based on a simple personnel management information system of common enterprises, give full play to the amount of information stored in SQL database big advantage, combined with the powerful function of C++ language in programming, and developed the personnel information management system has its own characteristics. This design is mainly to achieve the following functions: staff information browsing, add and delete functions, query, sorting screening function, authority restriction function, salary calculation function.…”

SQL Injections through Back-End of RFID System

“…For example, in MS SQL Server, XP_CmdShell of the database will carry out a random instruction of the operating system [6].…”

“…--", then following "WHERE Uid=%id" will be the annotation, and no longer be compiled [6]. This UPDATE sentence will affect each line in the field "Contents", realize their own duplication, and create the destruction to all of the original information of this field.…”

Fragmented malware through RFID and its defenses

“…In our previous work [6], we also demonstrated such vulnerabilities in MS SQL system which the other paper fell short on. We showed how attackers can use SQL injection attacks in conjunction with RFID middleware to compromise the infrastructure [7]. SQL injection happens when a developer accepts user input that is directly placed into a SQL Statement and doesn't properly filter out dangerous characters.…”