Be careful – New Malware in Web Apps
April 17, 2009 Computer Safety Tip
Rather than attacking operating systems, cybercrooks are increasingly going after vulnerabilities in Web applications. 
Gartner Blog Network member, Neil MacDonald said that Microsoft and the other OS vendors are getting better as producing more secure code and they are getting better at patching. But the applications and databases on the Internet, visited by millions who leave vast amounts of personal information, offer a relatively unguarded goldmine.
According to MacDonald, SQL injection attacks increased 30-fold in the last six months, yet 74% of Web application vulnerabilities disclosed in 2008 had not been patched by the end of the year. MacDonald said, “If we don’t proactively start efforts now to produce more secure applications and demand the same from our software providers, the bad guys will find the vulnerabilities for us.”
Fortunately, MacDonald isn’t the only one to notice the trend. A Tuesday MX Logic article noted a huge jump in the number of SQL attacks at the end of 2008, most of which were “designed to steal customer data from user-facing e-commerce websites.” Others were used to infect PCs. One unnamed security firm “found 780,000 malicious web pages last April from a single SQL injection attack.”
