Forgot your password?
typodupeerror
Security

Half a Million Microsoft-Powered Sites Hit With SQL Injection 222

Titus Germanicus writes to tell us that a recent attack has compromised somewhere in the neighborhood of 500,000 pages with a SQL injection attack. The vulnerability seems to be limited to Microsoft's IIS webserver and is easily defeated by the end user with Firefox and "NoScript." "The automated attack takes advantage to the fact that Microsoft's IIS servers allow generic commands that don't require specific table-level arguments. However, the vulnerability is the result of poor data handling by the sites' creators, rather than a specific Microsoft flaw. In other words, there's no patch that's going to fix the issue, the problem is with the developers who failed follow well-established security practices for handling database input. The attack itself injects some malicious JavaScript code into every text field in your database, the Javascript then loads an external script that can compromise a user's PC." Ignoring corporate spin-doctoring, there seems to be plenty of blame to go around.
Programming

Ruby and Java Running in JavaScript 220

John Resig is reporting on his blog that a recent trip to Tokyo opened up some very interesting JavaScript projects to him that haven't met with widespread popularity outside of Japan yet. "One project, in particular, really caught my eye. It's called Orto and is an implementation of the Java Virtual Machine (JVM) in JavaScript. This means that you can take an existing Java application, compile it to bytecode, run it through Orto (which produces the JavaScript, and embed it in a web page. While it doesn't provide the full capabilities of most Java code it does provide enough to make for some interesting demos." In a separate post he also detailed how the HotRuby project is allowing a Ruby VM to run in a browser using JavaScript or even indirectly using ActionScript in Flash.
Networking

Journal Journal: Support Net Neutrality, get laid??? 1

The page [with NSFW pic, depending on where you work...] starts with a line guaranteed to catch a geek's attention:

I will make love with every virgin who defends the Internet.

Yep, she's got our attention, especially with that image and the next few lines...

Security

500 Thousand MS Web Servers Hacked 332

andrewd18 writes "According to F-Secure, over 500,000 webservers across the world, including some from the United Nations and UK government, have been victims of a SQL injection. The attack uses an SQL injection to reroute clients to a malicious javascript at nmidahena.com, aspder.com or nihaorr1.com, which use another set of exploits to install a Trojan on the client's computer. As per usual, Firefox users with NoScript should be safe from the client exploit, but server admins should be alert for the server-side injection. Brian Krebs has a decent writeup on his Washington Post Security Blog, Dynamoo has a list of some of the high-profile sites that have been hacked, and for fun you can watch some of the IIS admins run around in circles at one of the many IIS forums on the 'net."
Windows

Why "Vista" Nick White Left Microsoft 130

An anonymous reader writes "Earlier this week Nick White, Product Manager for Windows Vista and blogger at WindowsVistaBlog, announced that he was leaving Microsoft. Geek.com previously interviewed Nick about what SP1 for Vista was all about, so they sat down with him yesterday to get the details behind his departure, his proudest moments at Microsoft, a few regrettable moments, and more."

Slashdot Top Deals

Man is an animal that makes bargains: no other animal does this-- no dog exchanges bones with another. -- Adam Smith

Working...