New SQL attacks emerge

Security researchers are warning of a new round of SQL attacks being reported.

Researchers at F-Secure are reporting an outbreak of attacks that mainly target Chinese sites.

Attackers have been using SQL vulnerabilities to inject malicious code into individual web pages. The code then redirects the user to an attack page, which attempts to exploit a number of vulnerabilities on the user's system and install malware.

If the attack is successful, the user is infected with a trojan that logs and transmits password information for a number of online games.

The company noted that the attacks appear to be targeting Chinese-language sites and software vulnerabilities almost exclusively.

"With all the attention on China these days, especially in conjunction with the Beijing 2008 Olympics Games, and with ‘China’ being one of the more popular search engine keywords at the moment, it makes sense for malware writers to focus their attention on the Chinese web," F-Secure said.

Security firm Sans is also receiving reports of SQL injection attacks. The company estimates that at least 4000 pages are currently infected.

SQL injection attacks have become increasingly popular over the last year. Experts recommend that site administrators follow a series of best practices to prevent attacks and keep a careful eye on log files.

Copyright ©v3.co.uk

attacksemergenewsecuritysql