Security Bites podcast: SQL-injections hit the Web

By CNET News.com Staff

Published: May 2, 2008 4:11 PM PDT

E-mail Story

The last few weeks have seen a surge in SQL attacks. Some, most likely using an automated tool, has involved adding malicious code to legitimate Web sites. For the end user, there's no way to tell that you are visiting a comprised site. Silently, your browser downloads the malicious content onto your PC.

This week Robert talked with Jeremiah Grossman, CTO for WhiteHat Security. Grossman said that what's different about these latest attacks is that someone has found a generic way to compromise Microsoft-SQL sites, which number in the thousands. Before, SQL-injection attacks were niche, targeting travel sites or sports sites, but these recent attacks have affected commercial, educational and even government sites.