Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

7/2/2008
01:46 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Sony PlayStation Site Hacked With 'Scareware'

The site runs a script that pretends to do an online security scan of your computer and presents a bogus warning message that your PC is infected with malware, researchers said.

A new wave of SQL injection attacks is spreading across the Internet, and Sony USA's PlayStation Web site is among the victims.

"Visiting the affected PlayStation site runs a script that pretends to do an online security scan of your computer, and presents a bogus warning message that your PC is infected with a variety of different pieces of malware," the SophosLabs blog explains. "Users frightened by the scareware 'warnings' might rush to spend money on useless software."

SQL injection attacks involve passing malicious code to SQL databases as user input. An improperly configured or vulnerable SQL application can be made to execute that input. All that's needed is to add HTML into a Web page that calls a script on a malicious site.

Since January, SQL injection attacks have surged across the Web. Researchers at the SANS Internet Storm Center and elsewhere have said that the reason for this is the existence of an automated tool that searches for sites running vulnerable software and attacks them. Attackers can configure the tool to insert any code they want.

Graham Cluley, senior technology consultant, said that the code used in the Sony site attack is just a snippet of code that pulls in content from a malicious site. The malicious code currently just tries to scare visitors to Sony's PlayStation site with bogus malware warnings, but it could just as easily install a keylogging Trojan, he said.

Cluley said that the malware has been active for a day or two and that Sony has been alerted to its presence. "The last time we looked the problem was still present," he said.

This is not a problem exclusive to Sony, however. "We are seeing hundreds of legitimate Web sites affected by this every day," Cluley said. "If you're a business, you need to harden your Web site to stop this from happening again and again."

Cluley noted that users of Firefox 3 should be immune to this attack because it recognizes third-party sites hosting malicious code as part of its new anti-malware functionality. "The good news is that Firefox 3 does actually intercept the attempt to go to the malicious Web site," he said. He also said that a plug-in called NoScript can help keep Firefox 2 and 3 users safe.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/1/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Threat from the Internet--and What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15478
PUBLISHED: 2020-07-01
The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
CVE-2020-6261
PUBLISHED: 2020-07-01
SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired.
CVE-2020-15471
PUBLISHED: 2020-07-01
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
CVE-2020-15472
PUBLISHED: 2020-07-01
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
CVE-2020-15473
PUBLISHED: 2020-07-01
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.