Cupertino succumbs to Jedi server trick
A hack attack that can expose users to malware exploits has infected more than 1 million webpages, at least two of which belong to Apple.
The SQL injection attacks bombard the websites of legitimate companies with database commands that attempt to add hidden links that lead to malware exploits. While most of the sites that fell prey appear to belong to mom-and-pop operations, two of the infections hit pages Apple uses to promote iTunes podcasts, this Google search shows. The malicious links appear to have been removed since Google last indexed the pages in early August.
In all, at least 538,000 pages have been compromised by the same attack. Attacks the bear similar fingerprints but point to different domains, as seen here, here and here – have claimed close to 500,000 more.
“These attacks have been ongoing and are changing pretty often,” said Mary Landesman, a senior researcher with ScanSafe, a Cisco-owned service that provides customers with real-time intelligence about malicious sites. “Interestingly, many of the sites compromised have been involved in repeated compromises over the past few months. It’s not clear whether these are the work of the same attackers or are competing attacks.” […]
The attacks that hit Apple used highly encoded text strings to sneak past web-application filters. SANS handler Manuel Humberto Santander Pelaez has technical details here. They are only the latest in a series of hack attacks to hit large numbers of websites.