ANI File Exploit Has Connection With Hacked Super Bowl Site

Another follow-up to my Unpatched Drive-By Exploit Found On The Web post.

Last month Websense reported that the official website of Dolphin Stadium, host of Super Bowl XLI, was compromised and serving malicious code.  In fact that was a massive attack affecting thousands of websites.  Those sites were injected with a script reference that pointed to exploit code.  At that time, the code exploited known vulnerabilities.

The SANS Institute did some investigating into that incident.  They posted portions of a response they received from a system admin where it was clear that a remote attacker exploited a SQL injection vulnerability to embed the malicious script.  The same script is now serving the ANI file 0-day exploit reported yesterday.  Googling the referenced script yields 113,000 results.  It’s likely that most of those sites were compromised through SQL injection vulnerabilities.  Of course many of these sites have been cleaned up, malicious references removed, but not all.