Kenneth C. Laudon,Jane P. Laudon Management Information System 12th Edition pdf

SQL injection attacks

are the largest malware threat. SQL

injection attacks take advantage of vulnerabilities in poorly coded Web applica-

tion software to introduce malicious program code into a company’s systems

and networks. These vulnerabilities occur when a Web application fails to prop-

erly validate or filter data entered by a user on a Web page, which might occur

when ordering something online. An attacker uses this input validation error to

send a rogue SQL query to the underlying database to access the database, plant

malicious code, or access other systems on the network. Large Web applications

have hundreds of places for inputting user data, each of which creates an

opportunity for an SQL injection attack.

A large number of Web-facing applications are believed to have SQL injection

vulnerabilities, and tools are available for hackers to check Web applications for

these vulnerabilities. Such tools are able to locate a data entry field on a Web

page form, enter data into it, and check the response to see if shows vulnerabil-

ity to a SQL injection. 

Some types of spyware also act as malicious software. These small programs

install themselves surreptitiously on computers to monitor user Web surfing

activity and serve up advertising. Thousands of forms of spyware have been

documented.

Many users find such 

spyware

annoying and some critics worry about its

infringement on computer users’ privacy. Some forms of spyware are espe-

cially nefarious.