Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


07:00 AM
Connect Directly

Report: Web-Borne Malware Up 278% This Year

SQL injection attacks dominate first half of '08, and cross-site scripting (XSS) doesn't even make the list

The multiple waves of mass SQL injection attacks this year on Websites -- including many high-profile legitimate ones like Wal-Mart, Business Week, and Ralph Lauren Home -- helped boost Web-borne malware volumes by 278 percent in the first half of this year, according to a new report from ScanSafe.

More than half of the malware detected by the Web security-as-a-service provider came from legit Websites rather than from notoriously scary or sketchy ones. And many of these Web attacks are silent and so tough to detect that many site operators have no clue their sites are lethal, and users often get infected without ever knowing it, according to the report.

SQL injection is the attack method of choice, too. In June, 76 percent of Website compromises were due to SQL injection attacks, followed by PHP includes (12 percent), so-called long-tail attacks that are engineered with stolen FTP credentials (7 percent), and others (5 percent).

What about the most pervasive Web vulnerability, cross-site scripting (XSS)? “It’s certainly possible that XSS in some cases could be used to launch an SQL injection attack,” says Mary Landesman, senior security researcher for ScanSafe. “But in general, the bulk of the 2008 SQL injection attacks appear to be the result of non-browser-based automated tools -- not via browser-executed JavaScripts, which would be reflective of XSS,” for example.

Landesman notes that some would argue that the outcome of an SQL injection attack is basically a persistent/static XSS attack. “Using that argument, maliciously embedded iFrames (even if done via direct upload as a result of compromised FTP credentials) could also be described as an XSS attack. This gets down to a matter of semantics. I don’t personally subscribe to the end result being described as an XSS attack, but I can agree that, fundamentally, it has the same impact,” she says.

Most Web attacks try to install password-stealing malware and backdoor Trojans, which constituted about 4 percent of all malware detected by ScanSafe in January and, as of June, had climbed to 27 percent. Password stealers are often linked via IRC channels to the attacker, which then configures files that order what data the password stealer should grab.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • ScanSafe

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Register for Dark Reading Newsletters
    White Papers
    Cartoon Contest
    Current Issue
    Navigating the Deluge of Security Data
    In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2019-12-05
    lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
    PUBLISHED: 2019-12-05
    fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact because of incorrect fpu_fpregs_owner_ctx caching, as demonstr...
    PUBLISHED: 2019-12-05
    OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.
    PUBLISHED: 2019-12-05
    The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.
    PUBLISHED: 2019-12-05
    D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.