4000 sites hit in new mass SQL injection attack

By

Exploits Microsoft software.

Yet another massive SQL injection attack may be underway, according to the SANS Internet Storm Center.

4000 sites hit in new mass SQL injection attack

Based on a Google search of the malicious string being used, more than 4000 websites have been infected, SANS handler Mark Hofman said in a post Friday.

That is a rapid rise from Thursday, the day the ambush was first detected, when only about 80 sites appeared to be compromised.

Impacted sites appear to be running Microsoft Internet Information Services (IIS) or Microsoft SQL web servers and are using software from ASP.NET or ColdFusion, Hofman said.

Visitors to hacked sites are being redirected to pages trying to push rogue anti-virus programs or another payload.

"The hex will show in the IIS log files, so monitor those," Hofman wrote. "Make sure that applications only have the access they require, so if the page does not need to update a (database), then use an account that can only read."

He also recommended blocking access to the malicious redirect site.

Similar waves of SQL injection attacks have been common for years, including a major one earlier this year.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Log In

  |  Forgot your password?