Hackers that visit a Romanian Web site, Hackersblog, have claimed the third straight breach of a security vendor's Web site using SQL injection in a week.

This time, it's F-Secure [1], a Finnish antivirus vendor.

SearchSecurity.com reports [2]:

A Romanian hacker has detailed the latest SQL injection attack in a posting on the hackersblog.org forum. [3] The anonymous hacker said he viewed some statistics regarding past virus activity after exploiting coding errors on the Helsinki, Finland-based antivirus vendor's website. The hacker said the website was vulnerable to both SQL injection and cross-site scripting attacks.

The hacker posted screenshots of the SQL Server information and database table names.

"It was not even part of our critical infrastructure, nonetheless we're considerably embarrassed," David Frazer, director of technology services for F-Secure's North American division, told the IT news site. "As a security company it's still something that we should make sure is patched and up to date."

An SQL injection takes a small malicious bit of code and inserts it into a database. When done properly an attacker can gain access to the breached database.

Also this week, two other hackers on the same site posted news that they successfully breached two other security Web sites using SQL injections.

A hacker known as Unu breached the Kaspersky's U.S. Labs Web site on Saturday, reports eFluxMedia [4].

"Kaspersky is one of the leading companies in the security and antivirus market. It seems as though they are not able to secure their own databases," Unu posted on Hackersblog. "Alter one of the parameters and you have access to EVERYTHING: users, activation codes, lists of bugs, admins, shop, etc.," he added.

Kaspersky officials said no sensitive information, such as credit card numbers, had been breached and that a specialist would conduct an audit of its systems.

Two days later, the Portugal Web site for BitDefender was breached.