Sophos has a short video showing evidence of a hacked page on the BusinessWeek web site. I was impressed by how Google Chrome handled this:
The interesting point is that we are finding malicious JavaScript on highly reputable sites. Sophos says this one was caused by SQL injection, and I noticed that the page uses Microsoft’s old .asp technology in which it was particularly easy to code insecurely.
What’s the solution? Beats me; there are just zillions of insecure web applications out there. However, it’s disappointing that BusinessWeek still has not cleaned up the pages, which were reported last week (but perhaps that means last thing Friday).