New mass SQL injection attack could be forming

By

More than 4,000 websites infected in less than 24 hours.

Yet another massive SQL injection attack may be underway, according to the SANS Internet Storm Center.

New mass SQL injection attack could be forming

Based on a Google search of the malicious string being used, more than 4,000 websites have been infected, SANS handler Mark Hofman said in a post Friday. That's a rapid rise from Thursday, the day the ambush was first detected, when only about 80 sites appeared to be compromised.

Impacted sites appear to be running Microsoft Internet Information Services (IIS) or Microsoft SQL web servers, and are using software from ASP.NET or ColdFusion, Hofman said.

Visitors to hacked sites, which are vulnerable because they haven't fully patched their applications and the databases that support them, are being redirected to pages trying to push rogue anti-virus programs or another payload.

"The hex will show in the IIS log files, so monitor those," Hofman wrote. "Make sure that applications only have the access they require, so if the page does not need to update a (database), then use an account that can only read."

He also recommended blocking access to the malicious redirect site.

Similar waves of SQL injection attacks have been common for years, including a major one that occurred earlier this year.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Log In

  |  Forgot your password?