Albuquerque, NM -- (SBWIRE) -- 04/13/2011 -- Recently, millions of web pages across the world suffered a massive SQL injection attack. The attack was first identified by Internet security firm Websense. Attackers injected SQL commands into the associated databases of websites by exploiting weaknesses in web applications. The code was designed to redirect users to different fake websites. Security researchers at Websense have termed the attack as ‘LizaMoon’ attack as that was one of the first websites to which victims were redirected. The redirected website warns the victims that their computer systems have been infected with malware and viruses. The site provides a link to download a fake anti-virus program called ‘Windows Stability Center’ and identifies itself as a Microsoft product to appear genuine to the users.
Once unwary users click on the link, they may inadvertently download malware in their computers instead of anti-malware software. Users are enticed to subscribe to a six month, 1 year or lifetime subscription of the fake software by displaying special discount offers. Unwary users, who choose to subscribe to the full version, may also compromise sensitive information such as names, addresses, contact numbers, e-mail addresses, credit card numbers, credit card expiry dates, card verification number and card verification code. According to a preliminary research by Websense, while majority of the visitors to the malicious website lizamoon.com hailed from United States (U.S), the site registered visits from all regions of the world. Security researchers are still investigating the attack and some of the domains used by the attackers to sell the fake software have been shut down.
Attackers are always on the lookout to exploit vulnerabilities in websites and web applications to dupe unwary Internet users. Lack of proper input validation is one of the major causes for the current spate of SQL injection attacks. Web applications that do not have filters to sanitize input for eliminating malicious commands are more vulnerable to such attacks. Organizations must scrutinize websites and applications for weaknesses and threat vectors at regular intervals. Developers must evaluate the security flaws in web applications and mitigate them to avoid exploitation by attackers. Professionals qualified in computer science degree and secured programming may help in identifying and mitigating programming errors. All inputs must be validated. Limits must be enforced on type and size of data entered. Inputs containing comment characters, escape sequences and binary data must be rejected or restricted. Use of parameterized queries and multiple layers of validation may help in prevention of SQL injection attacks.
Web application firewalls and web application scanners could help web administrators in understanding the vulnerability of websites to SQL injection attacks. E-learning and online university degree courses could help IT employees to update themselves on latest threats and preventive measures.
Video tutorials, online degree programs, security blogs and advisories may create cyber security awareness among Internet users. Users must download genuine security software by directly visiting legitimate websites. They must be vary of pop-ups warning of malware threat and desist from clicking on any links provided on them. Adherence to security guidelines, advisories and updates may help users to safeguard their systems.
Contact Press
EC-Council
Website: http://www.eccouncil.org
Email: iclass@eccouncil.org
Tel: 505-341-3228
About
EC-Council University is based in Albuquerque, New Mexico and offers Master of Security Science (MSS) degree to students from various backgrounds such as graduates, IT Professionals, and military students amongst several others. The MSS is offered as a 100% online degree program and allows EC-Council University to reach students from not only the United States, but from all around the world.
EC-Council is a member-based organization that certifies individuals in cybersecurity and e-commerce skills. It is the owner and developer of 16 security certifications, including Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (CHFI) and EC-Council Certified Security Analyst (ECSA)/License Penetration Tester (LPT). Its certificate programs are offered in over 60 countries around the world.
EC-Council has trained over 80,000 individuals and certified more than 30,000 members, through more than 450 training partners globally. These certifications are recognized worldwide and have received endorsements from various government agencies including the U.S. federal government via the Montgomery GI Bill, Department of Defense via DoD 8570.01-M, National Security Agency (NSA) and the Committee on National Security Systems (CNSS). EC-Council also operates the global series of Hacker Halted security conferences.