Mass website hacks here to stay

Simply removing exploit code may not protect sites from further infection

Security experts have warned that the recent rash of large-scale website attacks may not be a fleeting trend.

McAfee researcher Craig Schmugar believes that the attacks, which simultaneously target hundreds of thousands of web pages, could be a sign of things to come.

The nature of the attacks makes them very hard to prevent, and simply removing the exploit code may not protect sites from further infection.

"The bad guys are using automated tools to find and attack web applications that are vulnerable to SQL injection attacks," said Schmugar.

"Many of these applications are home grown and thus there is no patch or hotfix for administrators to install."

Schmugar's grim assessment follows several SQL injection attacks in recent months. The attackers are believed to have used automated scripts to run input-validation attacks on pages.

The script embeds a small section of JavaScript on the compromised page. Users attempting to access the pages are silently routed to a third-party site run by the attacker.

This page then attempts to execute a number of browser exploits in an effort to install malware.

Schmugar explained that the problem could be solved by updating pages to prevent the attacks, but that a fix will not be easy to come by.

"The entry point for these attacks must be closed in order to thwart future attacks. This means that underlying code must be audited and improper input-validation must be corrected," he said.

"Given that many web administrators install out-of-support freeware and shareware applications, we can expect many sites to remain vulnerable for a long time."