Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


07:00 AM
Connect Directly

Report: Web-Borne Malware Up 278% This Year

SQL injection attacks dominate first half of '08, and cross-site scripting (XSS) doesn't even make the list

The multiple waves of mass SQL injection attacks this year on Websites -- including many high-profile legitimate ones like Wal-Mart, Business Week, and Ralph Lauren Home -- helped boost Web-borne malware volumes by 278 percent in the first half of this year, according to a new report from ScanSafe.

More than half of the malware detected by the Web security-as-a-service provider came from legit Websites rather than from notoriously scary or sketchy ones. And many of these Web attacks are silent and so tough to detect that many site operators have no clue their sites are lethal, and users often get infected without ever knowing it, according to the report.

SQL injection is the attack method of choice, too. In June, 76 percent of Website compromises were due to SQL injection attacks, followed by PHP includes (12 percent), so-called long-tail attacks that are engineered with stolen FTP credentials (7 percent), and others (5 percent).

What about the most pervasive Web vulnerability, cross-site scripting (XSS)? “It’s certainly possible that XSS in some cases could be used to launch an SQL injection attack,” says Mary Landesman, senior security researcher for ScanSafe. “But in general, the bulk of the 2008 SQL injection attacks appear to be the result of non-browser-based automated tools -- not via browser-executed JavaScripts, which would be reflective of XSS,” for example.

Landesman notes that some would argue that the outcome of an SQL injection attack is basically a persistent/static XSS attack. “Using that argument, maliciously embedded iFrames (even if done via direct upload as a result of compromised FTP credentials) could also be described as an XSS attack. This gets down to a matter of semantics. I don’t personally subscribe to the end result being described as an XSS attack, but I can agree that, fundamentally, it has the same impact,” she says.

Most Web attacks try to install password-stealing malware and backdoor Trojans, which constituted about 4 percent of all malware detected by ScanSafe in January and, as of June, had climbed to 27 percent. Password stealers are often linked via IRC channels to the attacker, which then configures files that order what data the password stealer should grab.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • ScanSafe

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Data Privacy Protections for the Most Vulnerable -- Children
    Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
    Sodinokibi Ransomware: Where Attackers' Money Goes
    Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
    Register for Dark Reading Newsletters
    White Papers
    Current Issue
    7 Threats & Disruptive Forces Changing the Face of Cybersecurity
    This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
    Flash Poll
    2019 Online Malware and Threats
    2019 Online Malware and Threats
    As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2019-10-20
    ** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
    PUBLISHED: 2019-10-19
    The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
    PUBLISHED: 2019-10-19
    Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
    PUBLISHED: 2019-10-19
    templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
    PUBLISHED: 2019-10-18
    In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.