"The OS platform isn't as attractive a target as it once was," writes MacDonald. "Microsoft and the other OS vendors are getting better at producing more secure code and we are getting better at patching." But the applications and databases on the Internet, visited by millions who leave vast amounts of personal information, offer a relatively unguarded goldmine.

And criminals know it. According to MacDonald, SQL injection attacks increased 30-fold in the last six months, yet 74% of Web application vulnerabilities disclosed in 2008 had not been patched by the end of the year. "Most of us aren't ready...software vendors aren't ready either. It's pretty simple. If we don't proactively and demand the same from our software providers, the bad guys will find the vulnerabilities for us."

Fortunately, MacDonald isn't the only one to notice the trend. A Tuesday noted "A huge jump in the number of SQL attacks at the end of 2008," most of which were "designed to steal customer data from user-facing e-commerce websites." Others were used to infect PCs. One unnamed security firm "found 780,000 malicious web pages last April from a single SQL injection attack."

I've even become a victim and unwilling participant in such attacks. One of my own Web sites was hijacked last June, and started infecting visiting PCs with the . With the help of my web host (), I removed some offending files, replaced them with backups on my local hard drive, changed my password, and became much more vigilant about keeping updated. I came clean about the incident with two posts ( and ) to my readers.

You may also want to read this explanation of , from the Standard's Paul Boutin.