New mass SQL injection attack infects 56,000 websites

Share this article:
Tens of thousands of websites have been compromised with a suite of malware containing backdoors, password stealers and downloaders, according to a security firm.

“It's a pretty potent concoction, from a malware perspective,” Mary Landesman, ScanSafe's senior security researcher, told SCMagazineUS.com on Monday.

So far, more than 56,000 sites have been compromised -- via SQL injection -- with a malicious IFRAME that loads exploits from several attacker-owned domains, Landesman said. The malware-hosting domains were registered between Aug. 3 and 9.

The compromised sites can be identified through a Google search for a malicious IFRAME script tag. The infected sites vary in category, but a number of charitable, nursing and travel sites particularly have been targeted.

“In general, these are your mom-and-pop websites,” Landesman said. “They are not big-name sites, but they do extremely well in search engine results for niche markets."

For example, the websites of approximately 203 assisted-living facilities, all run by the same management company, were infected.

When a user visits one of the compromised sites, the IFRAME silently loads content from the malware-hosting sites, Landesman said. The attack runs through dozens of exploits to attempt to find one to which the user's machine is susceptible. Given the wide range of exploits being used, the chance of the attack being a success is fairly high, she added.

The malware ultimately is designed for data theft.

"[It] gives the attackers the ability to glean a great deal of information about the people who become infected,” Landesman said.

Infected websites have been the single biggest threat during the first half of the year, according to a report released in July by security firm Sophos. In addition, the top 100 “dirtiest” sites are hosting upward of 18,000 different pieces of malware on average.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.