Forget the OS: Malware aimed at Web applications is growing

"We Are Toast." So warns Gartner Blog Network member Neil MacDonald in a Monday post about the current trend in malware. Rather than attacking operating systems, cybercrooks are increasingly going after vulnerabilities in Web applications.

"The OS platform isn't as attractive a target as it once was," writes MacDonald. "Microsoft and the other OS vendors are getting better at producing more secure code and we are getting better at patching." But the applications and databases on the Internet, visited by millions who leave vast amounts of personal information, offer a relatively unguarded goldmine.

And criminals know it. According to MacDonald, SQL injection attacks increased 30-fold in the last six months, yet 74% of Web application vulnerabilities disclosed in 2008 had not been patched by the end of the year. "Most of us aren't ready...software vendors aren't ready either. It's pretty simple. If we don't proactively start efforts now to produce more secure applications and demand the same from our software providers, the bad guys will find the vulnerabilities for us."

Fortunately, MacDonald isn't the only one to notice the trend. A Tuesday MX Logic article noted "A huge jump in the number of SQL attacks at the end of 2008," most of which were "designed to steal customer data from user-facing e-commerce websites." Others were used to infect PCs. One unnamed security firm "found 780,000 malicious web pages last April from a single SQL injection attack."

I've even become a victim and unwilling participant in such attacks. One of my own Web sites was hijacked last June, and started infecting visiting PCs with the Trojan-Downloader.JS.Agent.D. With the help of my web host (IX Web Hosting), I removed some offending files, replaced them with backups on my local hard drive, changed my password, and became much more vigilant about keeping WordPress updated. I came clean about the incident with two posts (here and here) to my readers.

You may also want to read this explanation of how an SQL injection works, from the Standard's Paul Boutin.

The Industry Standard

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine