OSNews

Last week, The Washington Post reported that hundreds of thousands of IIS webservers were hacked. Code was placed on them that installed malware on visitors' computers. Among the infectees were websites from the UK government and the United Nations. Initial reports said the attackers used a security vulnerability in Microsoft's IIS, but the company published more information on the attacks today, and denies IIS was compromised.

In an entry on Microsoft's IIS Blog, Bill Staples explains that despite earlier reports online, the attacks are not related to Security Advisory 951306 or any other security flaw in Microsoft's IIS 6.0, ASP, ASP.Net or Microsoft SQL technologies. Instead, the crackers used automated SQL injection attacks.

Staples links to various websites that give more information on SQL injection attacks, and how to shield yourself from them. In addition, the IIS.net website follows the issue and provides more information as the case develops.

Microsoft's investigation revealed no unpatched security holes in IIS, SQL Server, Internet Explorer or any other Microsoft client software, so end-users should just install all the latest patches to shield themselves from these attacks.