[HIB]Newly detected SQL injection attack snags Apple in wide net

A new series of mass SQL injection attacks has planted links to malware sites and hidden iframes in over a million webpages, including parts of Apple's website. The technique is similar to a standard SQL injection attack, but uses obfuscation to disguise the data in hopes of routing around any rudimentary input checking. The attack was detailed earlier this week by security researcher Manuel Humberto Santander Peláez. The attacks rely on a series of SQL commands stored as hexadecimal data preceded by a CAST command. When decoded, it attempts to inject iframes into data tables, which then end up being rendered in webpages that use the tables to build its HTML code dynamically. The attacks lead to Russian top-level domains that appear to be sources of malware. While the attacks have affected mostly smaller sites that tend to invest less time in securing against attacks like SQL injection, The Register notes that even some Apple podcast pages succumbed to the attack. However, the links appear to have been removed since the attacks first started spreading earlier this month. Other pages affected include sites for a Pennsylvania county government, a UAE radio station, and a small book publisher.

**Hidden Content: To see this hidden content your post count must be 1 or greater.**