Risk
7/2/2008
01:46 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Sony PlayStation Site Hacked With 'Scareware'

The site runs a script that pretends to do an online security scan of your computer and presents a bogus warning message that your PC is infected with malware, researchers said.

A new wave of SQL injection attacks is spreading across the Internet, and Sony USA's PlayStation Web site is among the victims.

"Visiting the affected PlayStation site runs a script that pretends to do an online security scan of your computer, and presents a bogus warning message that your PC is infected with a variety of different pieces of malware," the SophosLabs blog explains. "Users frightened by the scareware 'warnings' might rush to spend money on useless software."

SQL injection attacks involve passing malicious code to SQL databases as user input. An improperly configured or vulnerable SQL application can be made to execute that input. All that's needed is to add HTML into a Web page that calls a script on a malicious site.

Since January, SQL injection attacks have surged across the Web. Researchers at the SANS Internet Storm Center and elsewhere have said that the reason for this is the existence of an automated tool that searches for sites running vulnerable software and attacks them. Attackers can configure the tool to insert any code they want.

Graham Cluley, senior technology consultant, said that the code used in the Sony site attack is just a snippet of code that pulls in content from a malicious site. The malicious code currently just tries to scare visitors to Sony's PlayStation site with bogus malware warnings, but it could just as easily install a keylogging Trojan, he said.

Cluley said that the malware has been active for a day or two and that Sony has been alerted to its presence. "The last time we looked the problem was still present," he said.

This is not a problem exclusive to Sony, however. "We are seeing hundreds of legitimate Web sites affected by this every day," Cluley said. "If you're a business, you need to harden your Web site to stop this from happening again and again."

Cluley noted that users of Firefox 3 should be immune to this attack because it recognizes third-party sites hosting malicious code as part of its new anti-malware functionality. "The good news is that Firefox 3 does actually intercept the attempt to go to the malicious Web site," he said. He also said that a plug-in called NoScript can help keep Firefox 2 and 3 users safe.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5104
Published: 2014-07-28
Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) a_country parameter in a process action to affiliate_signup.php, (2) affiliate_banner_id parameter to affiliate_show_banner.php, (3) country parameter in a process action ...

CVE-2014-5105
Published: 2014-07-28
Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php.

CVE-2014-5106
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php.

CVE-2014-5107
Published: 2014-07-28
concrete5 before 5.6.3 allows remote attackers to obtain the installation path via a direct request to (1) system/basics/editor.php, (2) system/view.php, (3) system/environment/file_storage_locations.php, (4) system/mail/importers.php, (5) system/mail/method.php, (6) system/permissions/file_types.ph...

CVE-2014-5108
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in single_pages\download_file.php in concrete5 before 5.6.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to index.php/download_file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.