New cyber attack compromises hundreds of thousands of websites

Hundreds of thousands of websites have been compromised by a massive cyber attack dubbed LizaMoon. The criminals behind the scheme inserted an external link onto various legitimate websites using an SQL injection attack.

The erroneous link redirects its victims to the criminals' webpage, which installs a piece of Rogue AV software called ‘Windows Stability Center’. The software warns users that their computer is infected with non-existent viruses, before offering a program to fix the problem - for a fee of up to US$79.90.

Read our Top Five Computer Viruses Of All Time.

Security firm Websense has been tracking the attack since it first surfaced on 29 March. The list of compromised websites originally totaled 28,000, but has since snowballed to include 226,000 URLs.

“All in all, a search on Google returns more than 1,500,000 results that have a link with the same URL structure as the initial attack,”  Websense reported. "...It makes it one of the bigger mass-injection attacks we have ever seen."

In a bid to hamper security researchers, the malicious code only appears once per IP address, so if you've already visited the site you won't get the code again.

According to the BBC, a Google search for the attackers' domains now returns more than three million web links. Most of the sites affected by the attack have been for small business and mid-tier organisations, although several iTunes URLs have also been compromised. However, because iTunes encodes script tags, the script doesn't execute on the user's computer, explains Websense.

At the time of writing, the sites offering the sham software had been shut down thanks to the efforts of security researchers. But the threat isn’t over, warns Websense. “The LizaMoon mass-injection campaign is still ongoing. …The URL that is injected is unavailable right now, but the server is still up and running, so that could change at any time.”  

Below is the video of the SQL injection attack in action, courtesy of Websense.