SQL injection attack hits 380,000 URLs

Payload sites inactive.

A massive SQL-injection attack has compromised 380,000 URLs, according to Websense.

The security firm first noticed the attack on Tuesday. From then, the number of affected URLs has jumped from 28,000 to 380,000 and counting - making it one of the largest such campaigns Websense has seen.

Affected sites are easy to spot by searching for the line of JavaScript that the attack inserts into a page, which links to a site called Liza Moon.

That site is currently down, but Websense said in a blog post it was redirecting users to a fake antivirus site earlier in the week.

Websense listed several iTunes URLs as compromised with the injected code, but said Apple's system doesn't execute the code, so users are safe.

Indeed, the "bad guys" haven't yet done much with the attack, Websense noted.

“We have been monitoring the attack since it came out and noticed that the number of the compromised URLs is still increasing... Different payload sites, have started to be involved in addition to the original Lizamoon.com," said Carl Leonard, threat research manager at Websense Security Labs.

"The payload sites remain inactive at present although they could be ‘switched’ on at any time," he added. "We can only speculate as to what the bad guys are waiting for.”

This article originally appeared at pcpro.co.uk