ie8 fix

rogers

Massive SQL-based Web attack decoded

On Wednesday, the SANS Internet Storm Center and others published details about the massive SQL-based Web attack that occurred over the weekend. The attack, says SANS, is similar to a smaller SQL-injection attack seen in November. At least 70,000 sites were compromised in a short period of time, leading some to speculate this was an automated attack.

From logs files, the attack code appears to exploit a variety of SQL injection vulnerabilities existing on Web sites using Microsoft SQL or Microsoft IIS. On the vulnerable sites, malicious JavaScript is injected into all variable character fields and text fields in … Read more

Baseball scandal generates 2 million downloads

Correction: Major League Baseball saw 2 million downloads not page views.

A steroid scandal may have irreparably tarnished baseball's image but it sure generated plenty of page views.

Major League Baseball released a report Thursday on the prevalence of performance enhancing drugs in the game and a copy of the report was downloaded from the league's Web site more than 2 million times.

The number would have likely been higher had popular sports sites operated by Sports Illustrated, ESPN and others, not posted copies as well.

An investigation by former Senator George Mitchell implicated more than 80 past … Read more

Baseball's steroid report available online

For those interested in checking whether their favorite professional baseball player is a cheat, Major League Baseball has posted a report on steroid use among current and former players.

The 304-page report can be found at mlb.com/mitchrpt.pdf (PDF). The document is the result of an investigation conducted by former Senator George Mitchell, who is scheduled to hold a press conference this morning.

MLB executives hired Mitchell in 2006.

Mitchell rounded up the usual suspects in his report, such as Barry Bonds, Roger Clemens, Gary Sheffield, and the brothers, Jason and Jeremy Giambi. But among the surprise players … Read more

Grisoft acquires Exploit Prevention Labs

Grisoft, maker of AVG antivirus and Internet security software, on Wednesday announced the acquisition of Exploit Prevention Labs, maker of the LinkScanner family of safe Web-browsing applications.

Unlike other safe-surfing applications, which tend to rely on databases, LinkScanner uses technology that determines, as the page is downloaded onto your browser, whether it is tainted with malicious software.

In CNET Reviews testing, LinkScanner has detected recent changes on Web pages where other safe surfing applications, such as McAfee SiteAdvisor, has not. One limitation of LinkScanner is its inability to determine whether a page is fraudulent; LinkScanner determines only whether the page … Read more

MySpace attack uses background images not iframes

Security researcher Roger Thompson has found a new way to link to malicious servers that doesn't involve iframes (inline frames). An attack in June used cross-site scripting to place malicious iframes on legitimate Web sites. Iframes are used by Web designers to open additional windows (often hosted on other sites) within a main Web page; iframes can also be used by criminal hackers to redirect browsers to malicious-code sites.

"The interesting thing about this is that rather than using an iframe for an automatic embed, as they usually do, they've added some sort of image background href, … Read more

Facebook banner ad serves an exploit

Security researcher Roger Thompson got a surprise the other night when he borrowed a computer to view a friend's Facebook blog--Internet Explorer wanted to download some malicious Microsoft Data Access Components (MDAC) objects. That didn't seem right, so he tried another computer, and said "I got extra copies of the browser starting, and ads being served."

Thompson is no stranger to such tricks. He heads Exploit Prevention Labs, a company that specializes in finding and mitigating browser exploits found on Web pages. This attack really surprised him. It uses an exploit of MS06-014, which means if … Read more

How big is YOUR bowl?

Did you grow up hearing that fish will grow as big as their bowl (or pond or ocean)? So that if you keep that carnival feeder fish in a tiny bowl it will stay tiny, but if you put it in the pond it'd get even larger? Well what about letting the FISH choose? With these nested "Russian Dolls" tanks, suddenly it is in the fish to choose whether they want to get bigger...and bigger...and it looks like at a certain point there is no turning back! (Although it can still see where it came from at all times.) Really, it is all a metaphor for life as we know it...cleanly and gorgeously abstracted to the world in the fish bowl

Roger Arquer's latest project, entitled Fish Bowls, presents 15 variations of the standard fishbowl... As Dezeen's article says, "Each piece examines a topic or suggests a solution to an issue," says Arquer. "'Dear Neighbour' (above), for example, tells us about the delicate relationships we have with our close neighbours, 'Suicidal Tendencies' prevents your fish from committing suicide, and 'Russian Dolls' (below) gives your fish a chance to decide how big it wants to be. I once read that a fish grows according to the space it has, that's what inspired me in this case." A few more bowls to get you started below...… Read more

Dangerous Web sites, strings attached

As the automated Mpack attack continues to turn thousands of legitimate Web sites into compromised sites offering drive-by downloads of malicious software, security researcher Roger Thompson over at Exploit Prevention Labs reminds us there are other exploits compromising legitimate sites, and some are as easy to find as entering a simple search string on Google. For more than a week (starting before the current Mpack attack), Thompson has been posting a list of dangerous search strings on his blog site. I've collected these and indicated in parentheses some of the known exploits associated.

atlas mountains country (WebAttacker 2 or … Read more