SANS ISC: SQL injections - an update - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

In an earlier story  we looked at an SQL injection that has infected close to 1.5 million sites.  The same search now only returns about 175K sites and many of those are discussing the injection.  The URLs I checked were all dead links, so well done everybody in cleaning up isle 3. 

With regards to the second set of SQL injections we talked about here  the number successful injections is still going up.  When I first came across these about 4.5k sites were injected,  now we are up to 33K.  Not a real success story for this particular attack.  The error with the 06014.html page is still not fixed.  The only variation I've seen so far is the target url which changes,  the rest is pretty much the same, the end game is still the stealing of WOW passwords.

People have reported that typically they get two hits from the one IP address and then it moves along. 

Keep an eye on your logs and consider implementing an IDS or use tools such as suhosin for PHP sites,  mod_security for apache, or any other url checking/sanitisation tool.

Mark - Shearwater