Timeline: Outbreak! - The rise of the SQL infection

gallery

The first six months of 2008 has seen a massive increase in SQL injection attacks, which can lead to legitimate websites we know and trust being compromised and infected with malware.

An SQL injection attack occurs when an attacker exploits weaknesses in the design of a website, gaining access and taking it over. Once in control of the database they will take data and add a malicious link. This usually takes the form of a drive-by download.

December 2006: Database attacks to increase in 2007

It was back at the end of 2006 when IT PRO first looked at the growing threat of the SQL injection attack. The chief executive of data security company Secerno Paul Davie predicted that by 2007, the SQL injection would become the number one attack vector on internet-facing systems.

August 2007: Hackers deface UN website in protest

Around this time last year, there was an SQL injection attack which was more about vandalism rather than financial motivation, but nevertheless saw major potential for damage. At the time there was surprise that it affected such a high profile website, but as 2008 has seen it is now much more common for this to happen.

April 2008: Microsoft denies fault for massive SQL attack

Last April saw one of the most serious SQL injection attacks in history, with half a million web pages affected thanks to an automated attack taking advantage of website vulnerabilities. Microsoft themselves denied responsibility for the problem, but it did show the size of the possible threat as well at the potential for harm.

May 2008: Websites hit by silent love China attacks

Another 9,000 Western websites were compromised thanks to an attack believed to have been launched from China. The attacks took advantage of Real Player and Internet Explorer vulnerabilities to inject an iframe which loaded malicious content – in this case a password stealing Trojan.

July 2008: NHS website affected by mass SQL ‘Asprox’ attack

IT PRO led with a story about an SQL injection attack caused by a Trojan toolkit called Asprox which worked by searching for Google pages which are ripe and vulnerable for an attack. Around a thousand websites were affected including many respectable and governmental organisations, included the official NHS website.

July 2008: One infected webpage every five seconds during 2008

The latest Sophos report showed very little hope of a solution to the increase in SQL attacks, confirming that SQL injection is one of the most dominant malware trends of 2008. The biggest problem was that many websites were not coded properly, and this was the vulnerability that allowed trusted places to get hit. Sophos claimed that the problem would only get worse in the next six months, and warned businesses to keep a close eye in keeping their online presences clean.

Email to a friend

Print this page