The website for Business Week magazine was compromised recently via an SQL injection, effectively making the website a virus replicator.
The website was exploited using a typical SQL Injection, where malicious SQL queries are executed directly by the SQL software due to a flaw in the website allowing users to have direct access to the SQL query, something that is a typical problem with newbie PHP programmers although the business week website is most likely Microsoft-hosted. The attackers used the vulnerability to infect the website’s users with a virus, ironically detected by a security firm running Macintosh computers.
The attackers are said to be from a Russian domain, which is currently down but could be brought back up to continue spreading malware at any time. All the more reason to run Antivirus, unless you use a Mac or Linux computer (note the top of the site).
One Response