A criminal hacker’s epiphany: Why not automate SQL inject attacks and use botnets to launch them?
That stroke of genius dawned on a criminal coder, possibly Chinese, a little less than a year ago. The result: in just 10 months, botnet-driven SQL injection attacks have been used to plant infections on multi-millions of webpages. These infections now lurk in wait for anyone who happens to click to what appears to be a reputable website. Click on a tainted webpage and you won’t notice anything amiss. But here’s what happens next: A backdoor gets silently implanted on your harddrive. Through that backdoor the attacker will send coding that silently turns your machine into obedient “bot.” Your botted PC gets slotted into a bot network of 10,000 or more other bots. As part of this botnet, your machine may be used to deploy spam, spread infections, steal data, launder stolen funds, participate in extortionist denial of service attacks or wage political warfare against small nations. And for good measure: a datastealer will also get installed on your harddrive; it will clean out your email
