Feeds

Apple.com hit in latest mass hack attack

Cupertino succumbs to Jedi server trick

Combat fraud and increase customer satisfaction

A hack attack that can expose users to malware exploits has infected more than 1 million webpages, at least two of which belong to Apple.

The SQL injection attacks bombard the websites of legitimate companies with database commands that attempt to add hidden links that lead to malware exploits. While most of the sites that fell prey appear to belong to mom-and-pop operations, two of the infections hit pages Apple uses to promote iTunes podcasts, this Google search shows. The malicious links appear to have been removed since Google last indexed the pages in early August.

In all, at least 538,000 pages have been compromised by the same attack. Attacks that bare similar fingerprints but point to different domains, as seen here, here and here – have claimed close to 500,000 more.

“These attacks have been ongoing and are changing pretty often,” said Mary Landesman, a senior researcher with ScanSafe, a Cisco-owned service that provides customers with real-time intelligence about malicious sites. “Interestingly, many of the sites compromised have been involved in repeated compromises over the past few months. It's not clear whether these are the work of the same attackers or are competing attacks.”

SQL injection attacks succeed because web applications don't properly filter search queries and other user-supplied input for malicious text. When the data is processed, commands are passed to a website's backend server, causing it to add links or cough up sensitive information.

The attacks that hit Apple used highly encoded text strings to sneak past web-application filters. SANS handler Manuel Humberto Santander Pelaez has technical details here. They are only the latest in a series of hack attacks to hit large numbers of websites.

The exploits used this time around weren't as effective as they might have been. According to Landesman, many of the iframes buried into the websites contained HTML that couldn't be rendered. ®

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.