Over the last few days, a mass SQL injection attack has been quickly gathering speed. Just three days ago only 28,000 URLs were affected, but at the time of writing, there could be up to
3.8 million infected URLs.
Websense has a complete write up the attack, dubbed 'LizaMoon,' but here's the basic gist: it looks like someone is exploiting a vulnerabilty (or vulnerabilities) in hundreds of thousands of websites running on Microsoft SQL Server 2003 and 2005. It's not yet known whether this is a vulnerability in SQL Server, or simply a case of outdated, unmaintained, and easily-exploitable CMSes.
The attack takes the form of an
SQL injection, which then inserts a link to a JavaScript file hosted on the attacker's server. This is repeated over and over until every Web page in the SQL database has been infected -- and considering 3.8 million URLs have been infected, you can see that this is a very easy, and
automated, attack.
Fortunately, the JavaScript isn't particularly malicious: it pops up a rogue AV program called Windows Stability Center, but that's it. Better yet, the rogue antivirus is
already recognized by a bunch of
real antivirus suites, including
Avast,
Panda and
Microsoft Security Essentials.
The real problem with SQL injection attacks is that there's nothing we surfers can do about them. There will always be old and unmaintained websites, and thus SQL injections will remain one of the easiest and most lucrative tools of hackers and spammers alike. All you can do is keep your
antivirus and
anti-malware software up to date, and pray.
Gargantuan SQL injection infects 3.8 million URLs, installs rogue antivirus originally appeared on Download Squad on Fri, 01 Apr 2011 05:30:00 EST. Please see our terms for use of feeds.
Permalink | Email this | Comments
cougar town brian regan mubarak
You may know Vudu as the startup bringing high definition movie rentals and rent-to-own services to set-top boxes like PlayStation 3 and the Boxee Box. And most TVs and Blu-ray players. Vudu recently became the second streaming service to receive its own dedicated button on Vizio's remote controls, following Netflix. You may also know Peter Gabriel, the British rocker who was inducted into the Rock and Roll Hall of Fame as a part of Genesis. The man responsible for Sledgehammer. What you may not know is that Gabriel is the front man and lead investor in a rapidly growing recommendation service called The Filter. Or that today The Filter is officially announcing that it has been tapped by Vudu to power its recommendation engine.
Ashton Kutcher started dabbling in tech startups a few years ago, but he is no longer a dabbler, as his his 
To celebrate the imminent marriage of Prince William and Kate Middleton, the Royal Collection