Mass SQL injection hits English language websites
Chinese hackers spread the silent love
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Thousands of websites in China have been booby trapped with code written to download Trojan software onto visitors who run vulnerable Windows PCs.
Unlike earlier rounds of SQL injection attacks the latest assaults mostly target English language sites (predominantly sites hosted in China but with a .com suffix) and purposefully avoid Chinese government sites, according to net security firm ScanSafe. The latest attacks inject an iFrame onto compromised sites that loads malicious scripts from qiqigm.com, a domain registered on 16 May. These scripts includes the text "silent love china" in an apparently greeting to other Chinese hackers
The malicious code exploit well-known RealPlayer and Internet Explorer vulnerabilities to install a password-stealing Trojan that hides its presence on Windows PCs. More than 7,000 sites have been compromised in this way, reports Mary Landesman, ScanSafe's senior security researcher.
English language Hong Kong stock brokerage kgieworld.com and Kodak camera reviews at digitalcamerareview.com are among the sites hit by the drive-by download attack.
The attacks are the latest in a wave of SQL injection attacks against websites that began this month. More than one group, using different sets of tools to inject attack code, is involved, according to F-Secure, the net security firm
Trend Micro says two exploits used in the latest SQL injection attacks are related to Chinese-language software, suggesting miscreants are specifically targeting the Chinese speaking world. Its analysis - which includes graphics illustrating the attack - can be found here. ®
COMMENTS
Re: Did someone say something
"why should we be serving you?" Huh? Well who are you? If you're just running your own private blog server, then fair enough, block whoever you like, it's your machine, nobody's going to care. If you're involved in any sort of commercial operation then what on earth are you on? Blocking random chunks of the IP address space has to be about the laziest, stupidest and least effective security method around. Why don't you just block all IP addresses that end in a number under 128, then you're 50% less likely to be attacked!
Good grief...
Did someone say something
I thought I heard a ping from Hong Kong just then :)
Anyone can block traffic if they like, if it is their equipment, there is no law saying it has to be open. In fact since blocking a huge chunk of the net the number of attempted attacks have gone down considerably, and the amount of useful traffic has increased also considerably.
Criminal denial of service eh? Oh, and why should we be serving you? And gross stupidity, well I think you have more than your fair share :)
Most sites, want quality traffic, not crack attempt after crack attempt, sure if some place has to communicate with a site then they can be added to a white list. It does actually make a lot of sense in many scenarios. So you're in Hong Kong why do we care?
Re: Just block APNIC on the firewall
What a good idea! Instead of fixing the problem, just take apart the internet.
Any SysAdmin who does that kind of blanket blocking should be prosecuted for a criminal denial of service attack, and gross stupidity. Think about it, there's not even any evidence that the attacks are *originating* in the APNIC, it could be the scumball in the cubical next to you supplementing his income breaking into poorly-protected home user PCs in APNIC to bounce the attacks. Or, from an economic perspective, look at China's GDP growth - think your multinational companies are going to want a piece of that? How will they communicate if idiots like you block them.
I'm physically in Hong Kong, China, but I'd like to think that this inter-thingy is making the world more connected...
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
