Details on defacement of Microsoft's U.K. Web site
Company says breach last week by hackers likely had no impact on customers, but it continues to investigate the incident.
Hackers broke through the site's security, defacing it and replacing genuine content with a photo of a child waving a Saudi Arabian flag.
It is likely that the company's U.K. site, which was breached on Wednesday, was subverted using an SQL injection, in which hackers exploit application vulerabilities to alter server settings or mine data, according to Zone-H, which has also run a picture of the defacement.
"Most probably, the attacker exploited the site by means of SQL injection to insert HTML code in a field belonging to the table which gets read every time a new page is generated," Zone-H said on its site.
Microsoft said it is investigating the breach. "Microsoft has learned of a criminal attempt to deface a subsite of Microsoft.com," the company said in a statement. "Upon notification of the criminal activity, Microsoft took the appropriate action to resolve the issue and stop any additional criminal activity.
"Microsoft is not currently aware of any customer impact as a result of this criminal activity but will continue to investigate the incident and take any necessary action to help protect customers. In addition, the defaced Web site was restored to its original content within hours.
"We apologize if customers are inconvenienced by the unavailability of the affected Web site. Microsoft is committed to helping protect our customers and we're working diligently with the third-party hosting company to ensure the continued security of the Web site."
Ed Gibson, Microsoft's chief security adviser in the U.K., played down the impact of the security breach. "I think it's always difficult when any company suffers from an intrusion by a criminal organization," he said. "As to the question of long-standing damage--(Microsoft will not suffer), because that particular matter was cleaned up quickly.
"Criminals are always trying to steal or break into systems--it shows we can't be complacent. By all of us working as an industry to make the (ecosystem) better, we'll continue to make it better tomorrow. Unfortunately, these things happen."
Patrick McLaughlin, the European director of security solutions at database company Oracle, said "software can never be fully tested."
"When building commercial software for databases," he added, "there's a finite amount of time to test it. Software is never bug-free." It is understood that it was not an Oracle database that was subverted.
Tom Espiner of ZDNet UK reported from London.