Last week, The Washington Post reported that hundreds of thousands of IIS webservers were hacked. Code was placed on them that installed malware on visitors' computers. Among the infectees were websites from the UK government and the United Nations. Initial reports said the attackers used a security vulnerability in Microsoft's IIS, but the company published more information on the attacks today, and denies IIS was compromised.
In an entry on Microsoft's IIS Blog, Bill Staples explains that despite earlier reports online, the attacks are not related to Security Advisory 951306 or any other security flaw in Microsoft's IIS 6.0, ASP, ASP.Net or Microsoft SQL technologies. Instead, the crackers used automated SQL injection attacks.
Instead, attackers have crafted an automated attack that can take advantage of SQL injection vulnerabilities in web pages that do not follow security best practices for web application development. While these particular attacks are targeting sites hosted on IIS web servers, SQL injection vulnerabilities may exist on sites hosted on any platform.
|
