• Total Posts: 28021
  • Total Topics: 8050
  • Online Today: 855
  • Online Ever: 51419
  • (01. January 2010., 09:27:49)

Author Topic: Mass SQL injection hits English language websites  (Read 1803 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7151
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum
Mass SQL injection hits English language websites
« on: 26. May 2008., 07:54:01 »

Thousands of websites in China have been booby trapped with code written to download Trojan software onto visitors who run vulnerable Windows PCs.

Unlike earlier rounds of SQL injection attacks the latest assaults mostly target English language sites (predominantly sites hosted in China but with a .com suffix) and purposefully avoid Chinese government sites, according to net security firm ScanSafe. The latest attacks inject an iFrame onto compromised sites that loads malicious scripts from, a domain registered on 16 May. These scripts includes the text "silent love china" in an apparently greeting to other Chinese hackers

The malicious code exploit well-known RealPlayer and Internet Explorer vulnerabilities to install a password-stealing Trojan that hides its presence on Windows PCs. More than 7,000 sites have been compromised in this way, reports Mary Landesman, ScanSafe's senior security researcher.

English language Hong Kong stock brokerage and Kodak camera reviews at are among the sites hit by the drive-by download attack.

The attacks are the latest in a wave of SQL injection attacks against websites that began this month. More than one group, using different sets of tools to inject attack code, is involved, according to F-Secure, the net security firm

Trend Micro says two exploits used in the latest SQL injection attacks are related to Chinese-language software, suggesting miscreants are specifically targeting the Chinese speaking world. Its analysis - which includes graphics illustrating the attack - can be found here:

News Source: The Register

Samker's Computer Forum -

Mass SQL injection hits English language websites
« on: 26. May 2008., 07:54:01 »


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising