Hackers hit Sony PS3 website

SQL injection vulnerability compromises web pages

Sony's PlayStation website has been compromised by hackers

Hackers have "compromised" pages on the US Sony PlayStation website, a security firm claimed today.

Sophos said that cyber-criminals used an SQL injection vulnerability to add unauthorised code to pages promoting PlayStation games SingStar Pop and God of War.

The malware claims to undertake an antivirus scan and displays a fake message stating that the visitor's computer has been infected.

The visitor is then urged to purchase a bogus security product to clean up the 'infection'.

Sophos warned that it would be "trivial" for the hackers who have compromised the web pages to alter the payload so that it became more malicious.

They could install code designed to harvest confidential information from users, or turn innocent victims' PCs into botnet zombies.

"There are millions of video game lovers around the world, many of whom will visit Sony's PlayStation website regularly to find out more about the latest console games," said Graham Cluley, senior technology consultant at Sophos.

"Most would never expect that surfing a website like this could potentially infect them with malware.

"It is essential that all websites, especially high profile ones like this, have been properly hardened to prevent hackers from injecting malicious code into legitimate web pages."