SQL injection

Members of hacktivist group Anonymous took center stage in the Occupy Wall Street protests this week, taking down the Oakland PD site in retaliation for Tuesday's violent anti-protest, calling for for more attacks on police sites and a citywide general strike Nov. 2.

Sony announced today it has hired a new VP and chief security officer: Philip Reitman, whose impressive resume includes time as a prosecutor, bureaucrat, upper level manager of large organizations, but little experience working inside a company to make sure its sites are secure.

Stringer: the 2nd-largest data breach in history was prompted by Sony suits against customers who mod its game console, not laughable security, poor management and ineffective response.

As at other breached sites, Sony customers used short, simple passwords that could be cracked easily; if Sony hadn't stored them as plain text that could be read without even that much effort.

Data breaches shake confidence in the cloud, blaming it for security gaps between new technology, old security policies and a human tendency toward trust. Fix that and you're golden.

The list of major Sony data breaches is approaching double digits, all apparently due to SQL attacks against flaws it should have fixed on all its sites after it got pwned the first time.

Security vendor Websense reports an SQL injection attack that has spread to more than 1.5 million web sites and shows no sign of stopping.

IBM's X-Force 2009 Trend and Risk report shows an 11 per cent drop in discovered vulnerabilities compared to 2008, including a decline in the largest categories like SQL Injections and ActiveX.

If you have a web site, the answer is undoubtedly "yes". Someone somewhere or, more likely, quite a few someones are attempting to attack your site or the system on which it is running. Assuming hackers have found your site and are testing it for holes that they might crawl through, let's take a look at how you can uncover evidence of their exploits with a quick examination of your web logs.

Intrusion-detection tools might seem up to the job of stopping SQL injection attacks, but they aren't.

Application-layer attacks bypass standard perimeter defenses. Here's how to evaluate firewalls that screen web app traffic.

Kaspersky warns that as many as 10,000 Web sites have been compromised in a mass Web attack.