Thousands of ASP sites affected

S

strummer

Guppy
I was curious if the folks at Jodohost were aware of this:

http://www.rumblepup.com/the-xiaobaishan-bomb-is-now-the-flyzhu-bomb/

Basically, tens (if not hundreds) of thousands of ASP based sites have been hit with this annoying little hack. A single Google search gives some insight into the types of sites that have been hit - many of them large, popular websites.

Anyways, I bring it up because the author in the above link mentions that this attack is the product of a vulnerability in Windows servers. A vulnerability that has been patched for, but obviously requires the necessary updating.

So far, I have had two different ASP.Net sites hit by this attack - one hosted on Jodohost, another hosted through a separate provider. Both sites employ many levels of protection against SQL injection in the code - so go figure.
 
Quick update:

Thanks to your suggestions, I found the hole in my code and quickly fixed it. They tried to wreck both sites again today but instead found themselves redirected to google search results on how to kill oneself. Not very classy on my part, but I guess it's all in good fun.

Thanks again!
 
strummer said:
Quick update:

Thanks to your suggestions, I found the hole in my code and quickly fixed it. They tried to wreck both sites again today but instead found themselves redirected to google search results on how to kill oneself. Not very classy on my part, but I guess it's all in good fun.

Thanks again!
Click to expand...


:D haha whatever works

You can find the attempts in http logs with SQL wording like declare, varchar, insert, etc for anyone else seeing this :)
 
You must log in or register to reply here.
Back
Top