Timeline: Outbreak! - The rise of the SQL infection

IT PRO has been watching and charting the progress of what is one of the biggest and most high profile web security threats of this year - the SQL injection.

The first six months of 2008 has seen a massive increase in SQL injection attacks, which can lead to legitimate websites we know and trust being compromised and infected with malware.

An SQL injection attack occurs when an attacker exploits weaknesses in the design of a website, gaining access and taking it over. Once in control of the database they will take data and add a malicious link. This usually takes the form of a drive-by download.

December 2006: Database attacks to increase in 2007

It was back at the end of 2006 when IT PRO first looked at the growing threat of the SQL injection attack. The chief executive of data security company Secerno Paul Davie predicted that by 2007, the SQL injection would become the number one attack vector on internet-facing systems.

August 2007: Hackers deface UN website in protest

Around this time last year, there was an SQL injection attack which was more about vandalism rather than financial motivation, but nevertheless saw major potential for damage. At the time there was surprise that it affected such a high profile website, but as 2008 has seen it is now much more common for this to happen.

April 2008: Microsoft denies fault for massive SQL attack

Last April saw one of the most serious SQL injection attacks in history, with half a million web pages affected thanks to an automated attack taking advantage of website vulnerabilities. Microsoft themselves denied responsibility for the problem, but it did show the size of the possible threat as well at the potential for harm.

May 2008: Websites hit by silent love China attacks

Another 9,000 Western websites were compromised thanks to an attack believed to have been launched from China. The attacks took advantage of Real Player and Internet Explorer vulnerabilities to inject an iframe which loaded malicious content in this case a password stealing Trojan.

July 2008: NHS website affected by mass SQL Asprox' attack

IT PRO led with a story about an SQL injection attack caused by a Trojan toolkit called Asprox which worked by searching for Google pages which are ripe and vulnerable for an attack. Around a thousand websites were affected including many respectable and governmental organisations, included the official NHS website.

July 2008: One infected webpage every five seconds during 2008

The latest Sophos report showed very little hope of a solution to the increase in SQL attacks, confirming that SQL injection is one of the most dominant malware trends of 2008. The biggest problem was that many websites were not coded properly, and this was the vulnerability that allowed trusted places to get hit. Sophos claimed that the problem would only get worse in the next six months, and warned businesses to keep a close eye in keeping their online presences clean.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

What is DevSecOps and why is it important?
Security

What is DevSecOps and why is it important?

30 Oct 2020
Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle
Security

Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle

30 Oct 2020
Ryuk behind a third of all ransomware attacks in 2020
Security

Ryuk behind a third of all ransomware attacks in 2020

29 Oct 2020
REvil hacking group says it has made more than $100m in a year
Security

REvil hacking group says it has made more than $100m in a year

29 Oct 2020

Most Popular

Do smart devices make us less intelligent?
artificial intelligence (AI)

Do smart devices make us less intelligent?

19 Oct 2020
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020
What is Neuralink?
Technology

What is Neuralink?

24 Oct 2020