Feeds

Virus writers go for Olympic gold

Back-ends left open to superbly over-muscled Trojan

Protecting against web application threats using SSL

Websites carrying news of the Olympic games have been targeted in a new wave of SQL injection attacks. Vulnerabilities in sites including New Delhi Television Limited's NDTV.com have been booby-trapped with exploits designed to install malware onto users' computers.

NDTV is syndicating AFP’s Olympic content but has failed to secure its back-end databases, leaving the site vulnerable to attack. Other news sites have made similar mistakes, leading hackers to take advantage and push a variant of the Asprox botnet Trojan, net security firm Sophos reports. It adds that failures in setting up servers correctly by client sites, rather than problems with the AFP feed, are the root cause of the problem.

The Asprox attack toolkit has been around for months, but has more recently become associated with a spate of drive-by download attacks that started in May 2008. The tool allows hackers to search for vulnerable websites that allow malicious script to be injected into their content. These scripts typically redirect surfers to sites controlled by hackers that take advantage of browser vulnerabilities and the like to download malware payloads onto vulnerable Windows PCs.

The drive-by download attack method relies on a combination of SQL injection vulnerabilities (or similar) on victimised websites and unpatched Windows clients to spread botnet clients or other form of malware.

F-Secure notes a separate wave of SQL injection attacks targeting Chinese-language websites. Flaws involving the popular Baidu search engine and Flash player are being used to serve up a Trojan design to steal the passwords of online games, it reports.

Olympics hackers going for the big medals are also aiming to ensnare victims using the more traditional method of infected email attachment. Files in circulation posing as a PowerPoint presentation on Olympic venues in Beijing are infected with backdoor code, McAfee warns. Panda Security adds that this malware dials home to a Chinese IP address in order to send back data harvested from infected machines. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.