Wine Technology Blog @ WineWeb.com

Recently we learned of a wine-related website that had been hacked at a particularily bad time (not that there is a good time to be hacked). While we sympathize with them on the effort required to get their site back up, we were a bit concerned as their site was running the ColdFusion software like ours. After some research, we're able to rest a bit easier.

The hack was a cross-site scripting attack, where someone adds malicious database code to a URL or a web form field. If the web program that processes the data expects an ID field in which to access the database, doesn't validate that it's just an ID field, and passes the entire field to the database access routine, then bad things can happen. Luckily our websites have several layers of protection to not allow this to happen to us.

We've noticed lately an increase in the frequency and sophistication of attempted attacks to our websites, but have considered them an annoyance to our schedule, as we typically alert the hacker's ISP of the attempted hack. Good programming practices and keeping up-to-date on server software is always a good defense.