I wonder if they are using the same (undocumented) exploit for each of these attacks.
I am certainly no expert in this field, but I would have thought discovering new exploits and security holes would take time, yet these guys are hitting several major sites a week.
It was being exploited in the wild at least as early as Dec 1st (based on log analysis I've seen). The rate of attempted exploits went WAY up after the 9th.
Also its worth considering that all these applications get updated like every week, so something that was ruled out in the past can be exploitable now.
Exactly. I intentionally posted this separately, because it's particularly interesting where and how the vulnerability was originally posted. And it certainly seems to have attracted some discussion.
Huh. This is a pretty straightforward vulnerability. The fact that it took anyone this look long to notice makes me skeptical that it's really this simple. I'll make a note to toy with this and see if it's actually exploitable.
That's how this vulnerability came to light. After finding out about the last vulnerability, there was a huge amount of interest in seeing if parameters could be exploited, leading to a number of people simultaneously discovering this flaw.
People have found a vulnerability and learned how to hack it.
reply