It can also be used to steal information, and to show that an attack is possible.
During the last few days a Romanian group has been doing SQL injection attacks on several security vendor's websites and early this morning they hit us. One of our servers used in gathering malware statistics had a page that didn't properly sanitize input and was therefore vulnerable to attack. Fortunately we utilize defense-in-depth strategies so the attack was only partly successful.
Although the attackers were able to read information from the database they couldn't write or manipulate it. And they couldn't access any other data on that server because the SQL user only had access to its own database, which only contains public information that is shown on our statistics pages. So while the attack is something we must learn from and points at things we need to improve, it's not the end of the world.
The malware statistics are something we publish anyway at worldmap.f-secure.com and because of our IT security strategy, the impact was minimal.
