4000 sites hit in new mass SQL injection attack

Yet another massive SQL injection attack may be underway, according to the SANS Internet Storm Center.

Based on a Google search of the malicious string being used, more than 4000 websites have been infected, SANS handler Mark Hofman said in a post Friday.

That is a rapid rise from Thursday, the day the ambush was first detected, when only about 80 sites appeared to be compromised.

Impacted sites appear to be running Microsoft Internet Information Services (IIS) or Microsoft SQL web servers and are using software from ASP.NET or ColdFusion, Hofman said.

Visitors to hacked sites are being redirected to pages trying to push rogue anti-virus programs or another payload.

"The hex will show in the IIS log files, so monitor those," Hofman wrote. "Make sure that applications only have the access they require, so if the page does not need to update a (database), then use an account that can only read."

He also recommended blocking access to the malicious redirect site.

Similar waves of SQL injection attacks have been common for years, including a major one earlier this year.

This article originally appeared at scmagazineus.com