Risk
7/2/2008
01:46 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Sony PlayStation Site Hacked With 'Scareware'

The site runs a script that pretends to do an online security scan of your computer and presents a bogus warning message that your PC is infected with malware, researchers said.

A new wave of SQL injection attacks is spreading across the Internet, and Sony USA's PlayStation Web site is among the victims.

"Visiting the affected PlayStation site runs a script that pretends to do an online security scan of your computer, and presents a bogus warning message that your PC is infected with a variety of different pieces of malware," the SophosLabs blog explains. "Users frightened by the scareware 'warnings' might rush to spend money on useless software."

SQL injection attacks involve passing malicious code to SQL databases as user input. An improperly configured or vulnerable SQL application can be made to execute that input. All that's needed is to add HTML into a Web page that calls a script on a malicious site.

Since January, SQL injection attacks have surged across the Web. Researchers at the SANS Internet Storm Center and elsewhere have said that the reason for this is the existence of an automated tool that searches for sites running vulnerable software and attacks them. Attackers can configure the tool to insert any code they want.

Graham Cluley, senior technology consultant, said that the code used in the Sony site attack is just a snippet of code that pulls in content from a malicious site. The malicious code currently just tries to scare visitors to Sony's PlayStation site with bogus malware warnings, but it could just as easily install a keylogging Trojan, he said.

Cluley said that the malware has been active for a day or two and that Sony has been alerted to its presence. "The last time we looked the problem was still present," he said.

This is not a problem exclusive to Sony, however. "We are seeing hundreds of legitimate Web sites affected by this every day," Cluley said. "If you're a business, you need to harden your Web site to stop this from happening again and again."

Cluley noted that users of Firefox 3 should be immune to this attack because it recognizes third-party sites hosting malicious code as part of its new anti-malware functionality. "The good news is that Firefox 3 does actually intercept the attempt to go to the malicious Web site," he said. He also said that a plug-in called NoScript can help keep Firefox 2 and 3 users safe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5075
Published: 2014-12-27
Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory corruption and panic) via a crafted IOCTL_ASWFW_COMM_PIDINFO_RESULTS DeviceIoControl request to \\.\aswFW.

CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2011-4722
Published: 2014-12-27
Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename field of an RRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2012-1302
Published: 2014-12-27
Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data_file or (2) settings_file parameter to ammap.swf, or (3) the data_file parameter to amtimeline.swf.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.