Super Bowl stadium website hacked

By Shaun Nichols on Feb 6, 2007 8:41AM

Page embedded with exploit code.

American Football fans looking for information on the Super Bowl in Miami may have found themselves with a nasty malware infection following a successful Web attack on Friday.

Dolphin Stadium, the venue for the game, had its website compromised and injected with exploit code, a stadium spokesman told vnunet.com.

The attack was detected and removed within a few hours, and the site currently poses no danger to users.

Initial reports of the attack surfaced late on Friday morning, when security firm Websense notified stadium management that the front page of the site contained a malicious piece of JavaScript.

The code attempted to exploit a pair of vulnerabilities that can allow for remote code execution.

The first, discovered in April 2006, affects Windows Data Access Components, and the second, disclosed in January 2007, affects Microsoft's Vector Markup Language component.

Both vulnerabilities have been patched by Microsoft, but users without the latest patches were susceptible to a Trojan application.

The malware installed a key-logger to steal information and a backdoor to allow an attacker to remotely control a system.

Dolphin Stadium was this year's venue for the National Football League's Super Bowl, the most watched sporting event of the year in the US.

The stadium website had been experiencing heavy traffic from the tens of thousands of people attending the game, as well as NFL fans linked to the site through various official Super Bowl websites.

The Indianapolis Colts won the NFL title with a 29-17 victory over the Chicago Bears.