/>
X

Vendor warns of 'Chinese' website attacks

Security vendor ScanSafe has warned IT professionals of a fresh wave of SQL injection attacks
tom-espiner.jpg
Written by Tom Espiner on

Security vendor ScanSafe has warned of a wave of SQL injection attacks that has affected over 7,000 web pages.

The attackers appear to be avoiding compromising Chinese government websites, while the attack code contains the text string "Silent love China", wrote ScanSafe researcher Mary Landesman in a blog post.

The attack, which began on Saturday, focused on systems running Microsoft SQL Server and ASP, and quickly infected thousands of web pages, according to the researcher. "The Yahoo search engine revealed 7,020 compromised pages over the course of the weekend," said Landesman.

Compromised sites include IPO listings on kgieworld.com, a Hong Kong stock brokerage, worldoil.com, and redmondmag.com, which should not be confused with redmondmagazine.com, a site for Microsoft developers.

Successful exploitation of a victim's computer leads to the installation of a password-stealing Trojan and a rootkit.

When a user visits a compromised page, their browser is redirected via SQL injection to another page, which in turn loads a second iframe. That iframe loads a script that assesses the victim computer for various vulnerabilities, including a memory corruption flaw in RealPlayer, reported in CVE-2008-1309.

Depending on whether the victim's computer is susceptible, it will be redirected to load content from one of several exploit pages. Successful exploitation results in the installation of the password-stealing Trojan. This password-stealer hooks into the Windows shell using the Control_RunDLL function.

IT professionals can use web-scanning and filtering technologies to gauge compromised sites, Landesman recommended.

Related

A United Airlines pilot made a big speech to passengers. Not everyone will love it
screen-shot-2022-08-09-at-9-39-33-am.png

A United Airlines pilot made a big speech to passengers. Not everyone will love it

Business
Dear American Airlines customers, your pilot today is a United Airlines trainee
gettyimages-1155904758-american-airlines-dreamliner2.jpg

Dear American Airlines customers, your pilot today is a United Airlines trainee

Business
An Apple employee told me the truth about the M2 MacBook Air (that was the problem)
screen-shot-2022-08-09-at-4-14-46-pm.png

An Apple employee told me the truth about the M2 MacBook Air (that was the problem)

Apple