Friday, March 30, 2007 11:34 AM
cmosby
McAfee Avert Labs Blog - ANI File Exploit Has Connection With Hacked Super Bowl Site
ANI File Exploit Has Connection With Hacked Super Bowl Site
Thursday March 29, 2007 at 11:03 pm CST
Posted by Craig Schmugar
Trackback
Another follow-up to my Unpatched Drive-By Exploit Found On The Web post.
Last month Websense reported that the official website of Dolphin Stadium, host of Super Bowl XLI, was compromised and serving malicious code. In fact that was a massive attack affecting thousands of websites. Those sites were injected with a script reference that pointed to exploit code. At that time, the code exploited known vulnerabilities.
The SANS Institute did some investigating into that incident. They posted portions of a response they received from a system admin where it was clear that a remote attacker exploited a SQL injection vulnerability to embed the malicious script. The same script is now serving the ANI file 0-day exploit reported yesterday. Googling the referenced script yields 113,000 results. It’s likely that most of those sites were compromised through SQL injection vulnerabilities. Of course many of these sites have been cleaned up, malicious references removed, but not all.
Source: Computer Security Research - McAfee Avert Labs Blog
Filed under: Security and Anti-Virus, Patch Management, Microsoft Windows, AntiVirus Information