Timeline: Outbreak! - The rise of the SQL infection

IT PRO has been watching and charting the progress of what is one of the biggest and most high profile web security threats of this year - the SQL injection.

The first six months of 2008 has seen a massive increase in SQL injection attacks, which can lead to legitimate websites we know and trust being compromised and infected with malware.

An SQL injection attack occurs when an attacker exploits weaknesses in the design of a website, gaining access and taking it over. Once in control of the database they will take data and add a malicious link. This usually takes the form of a drive-by download.

December 2006: Database attacks to increase in 2007

It was back at the end of 2006 when IT PRO first looked at the growing threat of the SQL injection attack. The chief executive of data security company Secerno Paul Davie predicted that by 2007, the SQL injection would become the number one attack vector on internet-facing systems.

Advertisement - Article continues below

August 2007: Hackers deface UN website in protest

Around this time last year, there was an SQL injection attack which was more about vandalism rather than financial motivation, but nevertheless saw major potential for damage. At the time there was surprise that it affected such a high profile website, but as 2008 has seen it is now much more common for this to happen.

April 2008: Microsoft denies fault for massive SQL attack

Last April saw one of the most serious SQL injection attacks in history, with half a million web pages affected thanks to an automated attack taking advantage of website vulnerabilities. Microsoft themselves denied responsibility for the problem, but it did show the size of the possible threat as well at the potential for harm.

May 2008: Websites hit by silent love China attacks

Another 9,000 Western websites were compromised thanks to an attack believed to have been launched from China. The attacks took advantage of Real Player and Internet Explorer vulnerabilities to inject an iframe which loaded malicious content in this case a password stealing Trojan.

July 2008: NHS website affected by mass SQL Asprox' attack

IT PRO led with a story about an SQL injection attack caused by a Trojan toolkit called Asprox which worked by searching for Google pages which are ripe and vulnerable for an attack. Around a thousand websites were affected including many respectable and governmental organisations, included the official NHS website.

July 2008: One infected webpage every five seconds during 2008

The latest Sophos report showed very little hope of a solution to the increase in SQL attacks, confirming that SQL injection is one of the most dominant malware trends of 2008. The biggest problem was that many websites were not coded properly, and this was the vulnerability that allowed trusted places to get hit. Sophos claimed that the problem would only get worse in the next six months, and warned businesses to keep a close eye in keeping their online presences clean.

Related Resources

Application security fallacies and realities

Web application attacks are the most common vulnerability, so what is the truth about application security?

Download now

Your first step researching Managed File Transfer

Advice and expertise on researching the right MFT solution for your business

Download now

The KPIs you should be measuring

How MSPs can measure performance and evaluate their relationships with clients

Download now

Life in the digital workspace

A guide to technology and the changing concept of workspace

Download now



Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Best antivirus for Windows 10

3 Sep 2019

Best free malware removal tools 2019

8 Mar 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

4 Nov 2019
Domain Name System (DNS)

Microsoft embraces DNS over HTTPS to secure the web

19 Nov 2019
Business strategy

The pros and cons of net neutrality

4 Nov 2019
social media

Can Wikipedia founder's social network really challenge Facebook?

19 Nov 2019