Internet monitoring firm Websense is warning of a huge SQL attack that has succeeded in infecting over 28,000 legitimate internet sites.
Dubbed LizaMoon after the originating domain lizamoon.com, the attack injects a single line of code into web sites that link the viewer to a well-known fake security software site at defender-uqko.in.
The attacking domain and the linking site are currently offline, but Websense said this could change at any time at the whim of the attacker. The lizamoon.com domain was set up three days ago using data which appears to be faked.
Websense has spotted some of the code in iTunes URLs, but said that Apple's security policies would have blocked any attack.
"The way iTunes works is that it downloads RSS/XML feeds from the publisher to update the podcast and list of available episodes. We believe that these RSS/XML feeds have been compromised with the injected code," Websense said in a blog post.
"The good thing is that iTunes encodes the script tags, which means that the script doesn't execute on the user's computer. So good job, Apple."
Geoengineering on the sea floor near glaciers would form a new ice shelf to prevent melting
Alterations in capillary blood flow can be caused by body position change
Curiosity rover is in 'normal mode' but not transmitting scientific data back to base
NatWest outage comes a day after Barclays' IT systems shut out customers and staff