Microsoft has found itself in the middle of a massive hacking attack, reports InformationWeek. Hundreds of thousands of Web pages using Microsoft IIS Web Server and Microsoft SQL Server have been compromised. The sites contain contain injected JavaScript that attempts to take advantage of known vulnerabilities.

Panda Security said it had previously notified Microsoft about a problem with its Internet Information Services, according to this Computerworld article. Microsoft even issued an advisory on April 17, but said it hadn't determined whether the site attacks were related to the advisory.

Now Microsoft denies that vulnerabilities in IIS are to blame and puts the responsibility on application developers. Jeremiah Grossman, CTO of White Hat Security, agrees with Microsoft. In this News.com piece, Grossman points out that any vendor could have been targeted with the attacks.

Last week, Earthlink made news when hackers used its servers to launch phishing attacks. Earthlink was offered up as an example of companies that have become so focused on money that they ignore basic programming techniques.

So what can you do to protect yourself? Security firm F-Secure advises IT administrators to block three domains associated with the SQL injection attacks: nmidahena.com, aspder.com, and nihaorr1.com. U.S. CERT says it would be a good idea to disable JavaScript and ActiveX, too, although Grossman says that's no guarantee. And if you're a developer, check out this "how to" from Microsoft on protecting against SQL injection.