Over 1 million WebPages were infected in the course of an attack that can expose users to malware exploits. Among these websites there are at least two that belong to Apple. The SQL injection attacks bombard the websites of legitimate companies with database commands that attempt to add hidden links that lead to malware exploits.
“These attacks have been ongoing and are changing pretty often,” said Mary Landesman, a senior researcher with ScanSafe, a Cisco-owned service that provides customers with real-time intelligence about malicious sites. “Interestingly, many of the sites compromised have been involved in repeated compromises over the past few months. It's not clear whether these are the work of the same attackers or are competing attacks.”
SQL injection attacks succeed because web applications don't properly filter search queries and other user-supplied input for malicious text. When the data is processed, commands are passed to a website's backend server, causing it to add links or cough up sensitive information.
The attacks that hit Apple used highly encoded text strings to sneak past web-application filters.
The exploits used this time around weren't as effective as they might have been. According to Landesman, many of the iframes buried into the websites contained HTML that couldn't be rendered.
