On March 12, McAfee's AVERT labs reported 10,000 Web pages using Active Server Pages (ASP) had been infected through SQL injection. A few days later, Microsoft employee Neil Carpenter detected 14,000 maliciously-modified Web pages. After the initial SQL injection, the automated attack injected a malicious Javascript or Iframe code to redirect visitors to criminal-controlled Web sites. The malicious Web sites then attempted to invisibly exploit end-users using multiple, previously patched vulnerabilities, or if no vulnerabilities were found, attempted to socially engineer the visitor into running additional software.

Following on the heels of this massive scale attack was another automated attack that made the first one seem small. McAfee reported more than 200,000 Web pages infected by an automated attack against phpBB software. phpBB is an open source Internet forum software product written in php. Users visiting an infected Web site were socially engineered into running additional (malicious) software programs.

Web site hacking is very popular. Zone-h, which tracks web site defacements, reported almost 500,000 hacked Web sites in 2007. And this is obviously a serious under-count, as most of Zone-h's data is self-reported by the hackers who hacked the Web sites. The professional criminal gangs involved in the majority of the Web hacks today don't report their activities to Zone-h. Even more interesting is Zone-h's track of the mechanism the hacker used to attack the Web site. By far the most popular method was simple password sniffing/cracking/guessing, but they track attacks against the DNS servers and routers that protect the Web servers.

One of the biggest changes over the past year, as reported by Google, is the inclusion of malicious advertisements on legitimate Web sites. Many legitimate sites end up unintentionally carrying advertisements from malware providers.

Perhaps the most interesting new Web hack trend is where inputted search phrases end up causing malicious cross-site scripting or poison normal search results. In the former attack, malicious hackers input dozens to hundreds of search strings into the search feature of a Web site that are in reality cross-site scripting attacks. In the latter hack method, the attacker poisons a legitimate search Web site by inputting hundreds to thousands of search strings to bring back specific malicious Web sites. An innocent user searching on the same key terms is inadvertently redirected to the malicious Web sites that have been artificially raised up in the search engine's rankings (based on the previous poisoned searches). Trying to prevent this latter type of attack is a new challenge for Internet search engines.

Web site penetration testers will tell you that most sites of even moderate complexity are hackable. The best Web site hackers say that no site is secure. Although that statement is certainly hyperbole, it isn't grossly inaccurate. There are probably more hackable Web sites than completely secure Web sites in the world.