Hackers hit Sony PS3 website

Hackers have "compromised" pages on the US Sony PlayStation website, a security firm claimed today.

Sophos said that cyber-criminals used an SQL injection vulnerability to add unauthorised code to pages promoting PlayStation games SingStar Pop and God of War.

The malware claims to undertake an antivirus scan and displays a fake message stating that the visitor's computer has been infected.

The visitor is then urged to purchase a bogus security product to clean up the 'infection'.

Sophos warned that it would be "trivial" for the hackers who have compromised the web pages to alter the payload so that it became more malicious.

They could install code designed to harvest confidential information from users, or turn innocent victims' PCs into botnet zombies.

"There are millions of video game lovers around the world, many of whom will visit Sony's PlayStation website regularly to find out more about the latest console games," said Graham Cluley, senior technology consultant at Sophos.

"Most would never expect that surfing a website like this could potentially infect them with malware.

"It is essential that all websites, especially high profile ones like this, have been properly hardened to prevent hackers from injecting malicious code into legitimate web pages."

See also:

PS3 firmware update adds online features

Trophies and in-game menu access added to console  01 Jul 2008

Malware growth slowing, say experts

Fewer new malware samples being found in the wild  02 Jul 2008

Turkish hackers crack Icann

NetDevilz strikes again  28 Jun 2008

Security experts warn of IE6 flaw

New attack for an old browser  27 Jun 2008

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!