New mass SQL injection attack could be forming

Yet another massive SQL injection attack may be underway, according to the SANS Internet Storm Center.

Based on a Google search of the malicious string being used, more than 4,000 websites have been infected, SANS handler Mark Hofman said in a post Friday. That's a rapid rise from Thursday, the day the ambush was first detected, when only about 80 sites appeared to be compromised.

Impacted sites appear to be running Microsoft Internet Information Services (IIS) or Microsoft SQL web servers, and are using software from ASP.NET or ColdFusion, Hofman said.

Visitors to hacked sites, which are vulnerable because they haven't fully patched their applications and the databases that support them, are being redirected to pages trying to push rogue anti-virus programs or another payload.

"The hex will show in the IIS log files, so monitor those," Hofman wrote. "Make sure that applications only have the access they require, so if the page does not need to update a (database), then use an account that can only read."

He also recommended blocking access to the malicious redirect site.

Similar waves of SQL injection attacks have been common for years, including a major one that occurred earlier this year.

This article originally appeared at scmagazineus.com