500 Thousand MS Web Servers Hacked

andrewd18 writes "According to F-Secure, over 500,000 webservers across the world, including some from the United Nations and UK government, have been victims of a SQL injection. The attack uses an SQL injection to reroute clients to a malicious javascript at nmidahena.com, aspder.com or nihaorr1.com, which use another set of exploits to install a Trojan on the client's computer. As per usual, Firefox users with NoScript should be safe from the client exploit, but server admins should be alert for the server-side injection. Brian Krebs has a decent writeup on his Washington Post Security Blog, Dynamoo has a list of some of the high-profile sites that have been hacked, and for fun you can watch some of the IIS admins run around in circles at one of the many IIS forums on the 'net."

ob...

[Anonymous Coward]

Does it run on linux.

LOL

[ThePhilips]

Lolicious.

I once spend an hour trying to explain IIS/MS SQL Server admin what PHP/MySQL addslashes()/mysql_escape_string() do - all to no avail. He was absolutely sure it is sufficient to like in VB surround any string with single quotes and it all will be fine.

Now seeing that it's real fun for guys, I can only laugh.

Re:Seems to be effecting older versions of IIS...

[geminidomino]

http://xkcd.com/327/ [xkcd.com]

Re:The Trojan is hosted in China

[Kong the Medium]

I'm sure you mean Persia.

And I'm sure you meant Turkey.(http://en.wikipedia.org/wiki/Troy [wikipedia.org]).

Re:epic lol

[Goaway]

Doing the same thing over and over and expecting different results?

Like flipping a coin?

Re:Bias?

[Anonymous Coward]

HA!, I'm immune from your puny attack. My users table is named Users_Obfuscated

Impressive fighter plane they have there

[hellfire]

I got hacked shortly after the hainan island incident in 2001. that is when the us spy satellite was bumped a chinese fighter, and was forced to land on hainan island (china).

Is that the fighter plane with warp drive and photon torpedos?

Sorry to pick on ya dude... it was a US spy plane, not a spy satellite :)

Re:epic lol

[digitalsolo]

It's about reality, not probability. If you throw a coin up, it will come down. Throwing it over and over, and expecting to suddenly not come down, is a good example. Yet, for some reason, I read comments every day, and still expect that everyone will "get it". Insanity indeed.

Re:Bias?

[Stellian]

In fact, the attack enumerates all ASP variables and tries to force a SQL payload in them, that in turn if executed adds the link to the malicious script to every textfield in the database. A very simple vulnerability scanner, if you like, targeting only ASP applications - thus the ISS spin.
Since we don't see the LAMP version spreading I think we can safely conclude that no web application written in PHP with a MySQL back-end is currently vulnerable to any type of SQL injection.

Re:This site makes me sick

[stubear]

Why would astronauts be writing web applications? Don't they have more important experiments to be conducting to waste time playing on the internet?

Re:ob...

[steelclash84]

Did you really name your kid "Robert'); DROP TABLE Students; --"?

Re:ob...

[hclewk]

Oh, yes. Little Bobby Tables, we call him.

Re:More data needed

[MacWiz]

the answer is it runs on Microsoft IIS server and Microsoft SQL Server.

Microsoft's technical team was taken by surprise, giving them fresh hope that they, too, can develop software which runs on Microsoft IIS server and Microsoft SQL Server.