New Database Attack Hits UN, UK, and DHS Sites
Charles Johnson
Mon Apr 28, 2008 at 3:43 pm PDT • Views: 222
Oops. Massive Attack: Half A Million Microsoft-Powered Sites Hit With SQL Injection.
A new SQL injection attack aimed at Microsoft IIS web servers has hit some 500,000 websites, including the United Nations, UK Government sites and the U.S. Department of Homeland Security. While the attack is not necessarily Microsoft’s fault, it is unique to the company’s IIS server.
The automated attack takes advantage to the fact that Microsoft’s IIS servers allow generic commands that don’t require specific table-level arguments. However, the vulnerability is the result of poor data handling by the sites’ creators, rather than a specific Microsoft flaw.
In other words, there’s no patch that’s going to fix the issue, the problem is with the developers who failed to follow well-established security practices for handling database input.
The attack itself injects some malicious JavaScript code into every text field in your database, the Javascript then loads an external script that can compromise a user’s PC.
Frank says: