Google Search Reveals Thousands of Hacked Websites

This week HD Moore released a more generic version of an exploit for the PHP programming language. 100's if not 1000's of PHP driven web applications are affected. If you run a PHP v4 driven web application, check to be sure that there is no code that unserializes POST or COOKIE data.

In the exploit announcement, HD Moore pointed out a Google search looking for hacked installations of the PHP forums system, phpBB. This is one of the applications vulnerable to the released exploit. A search for web pages with "Powered by phpBB" and "hacked by" returns a list of about 515,000 hacked websites. All of these websites, many of which belong to non-profit organizations, are likely trusted by visiting users. This trust could easily be abused by the hackers to deliver malware, steal passwords, identities, and more.