E(F)T Call Home(ATM)

450,000 Websites Attacked with SQL DAILY!

(up from 5000 per day during Q2 2008)

E.T. (Ehud Tenenbaum) a.k.a.(The Analyzer) allegedly used SQL injection exploits to gain access to these supposedly secure financial databases, giving him access to account and card details."

Let me be "The Analyzer" for a moment here. E.T. "gained access" to"supposedly secure""financial databases using SQL injection. Allow me to do some "needling" myself: Don't worry...I'll be NYCE...

When's the SeQueL? Who'sgoing to STAR in it? This guy Accel's in the Exchange of Information. So if you put your finger on the PULSE, then Shazam! You'll Discover that Tyme after time a PCI 2.0certified Hardware device designed for the web (can you say SAFE-T-PIN)is EXPONENTIALLY safer than a software approach.

But, I "could" be wrong. Guess we'll have to wait for the SeQueL. When it happens, it'll have a "familiar ring" to it.

Developing...in the meantime...E.F.T. - Call Home(ATM)! Hackers can "screw" with us all they want. We're impregnable!

E.T. End Encryption

Related articles

• ATM Megaheists Reach Epidemic Levels (wired.com)
• Safe-T-PIN Receives PCI 2.0 PED Certification - The Paypers (pindebit.blogspot.com)
• High-Tech Criminals Target ATMs to Steal Vital Personal Financial Information From Customers (pindebit.blogspot.com)
• Kaspersky denies leaks after SQL hack (news.cnet.com)
• Americans Have a False Sense of PC Security (pindebit.blogspot.com)

500,000 Websites Hit by SQL Injection in '08

darkReading says that SQL Injection hit 500,000 Websites last year:

Report: More Than 500,000 Websites Hit By New Form Of SQL Injection In '08
New Web breach incident report finds the bad guys deploying more automated attacks, targeting customers rather than data on sites

Feb 25, 2009 | 02:52 PM
By Kelly Jackson Higgins
DarkReading

A new flavor of an old-school Web attack was responsible for compromising more than 500,000 Websites last year.

An automated form of SQL injection using botnets emerged as the popular method of hacking Websites, according to a newly released report from the Web Hacking Incidents Database (WHID), an annual report by Breach Security and overseen by the Web Application Security Consortium (WASC). The report also found that attackers increasingly are targeting a Website's customers rather than the sensitive information in the site's database.

"It used to be that mostly e-commerce sites were targeted, but now it's potentially any site, especially those with a large customer base," says Ryan Barnett, director of application security research for Breach Security. "The attackers say, 'You're going to become a malware-launching point for us.'"

The so-called Mass SQL Injection Bot attacks basically automate the infection process; the Nihaorr1 and Asprox botnets both deployed this method last year, according to the report. "In the past, they had to do some manual reconnaissance with SQL injection to send the initial queries," Barnett says. The automated approach sent one request with a script that automated all of those recon steps -- using bots to perform the attacks.

"While the initial attack vector was SQL Injection, the overall attack more closely resembles a Cross-Site Scripting methodology as the end goal of the attack was to have malicious JavaScript execute within victims' browsers," the WHID reports says. "The JavaScript calls up remote malicious code that attempts to exploit various known browser flaws to install Trojans and Keyloggers in order to steal login credentials to other web applications."


Continue "darkReading"

Related articles

• F-Secure provides details on Web site breach (news.cnet.com)
• Audit: No customer data exposed in Kaspersky breach (news.cnet.com)
• Hacker site claims breach of third security firm Web site in a week (news.cnet.com)
• IBM: malware economics, web security biggest issues of 2008 (arstechnica.com)