SQL Injection: Albert Gonzalez Steals 130M Credit Card Numbers
http://ceoworld.biz/ceo/2009/08/19/review-on-master-hacker-albert-g...
Gonzalez and his team's entry technique is SQL injection attacks via organisation's web servers.
Similarly, a lot of malware are now spread via social networking sites and innocent people visiting infected websites.
Now, can we say all evil start from the Web?
;-)
PS: Gonzalez attacks compromised of the following steps:
• the initial web application compromise via SQL Injection
• the use of a well-known backend database command to make the attacks even more invasive
• the planting of malware on the backend database server
• the collection and transmission of credit card transactions to the attackers
Details are more suitable for an offline presentation.