Attacks/Breaches
12/16/2013
12:22 PM
Connect Directly
RSS
E-Mail
50%
50%

Advanced Power Botnet: Firefox Users, Beware

Malicious Firefox plugin scans websites for exploitable SQL injection vulnerabilities.

Beware a malicious Firefox browser add-on that infects PCs and makes them scan websites for known exploitable vulnerabilities.

The Firefox plugin, which has infected more than 12,500 systems to date, ties into what its developers have dubbed the "Advanced Power" botnet, according to security reporter Brian Krebs, who first reported on the attack campaign.

The add-on has been in circulation since at least May 31, 2013, according to malware analysis service Malwr. When the malware was first spotted, only two out of 47 antivirus engines were recognizing it as malicious code, according to Virus Total. By August 2013, however, 29 out of 45 antivirus scanning engines were flagging the code as malicious.

The malware sports a range of malicious capabilities, including password hijacking and data exfiltration. But those capabilities, at least to date, don't appear to have been activated on compromised -- aka zombie -- PCs that are part of the Advanced Power botnet. Rather, the compromised Windows systems appear to have been used solely to scour the web for sites that are vulnerable to SQL injection attacks.

[Despite Microsoft's earlier claims, the ZeroAccess infrastructure lives on. Read Microsoft Fails To Nuke ZeroAccess Botnet.]

To date, the botnet has reportedly identified 1,800 sites that are vulnerable to its collection of SQL injection attacks.

SQL injection refers to an attack technique that involves inserting malicious SQL statements into database queries -- for example, to dump the entire contents of a database. Such attacks can be blocked using a number of techniques, such as restricting web applications' access to databases, blocking all database inputs except ones that should be received, and encrypting all data stored in the database in case attackers still manage to gain access and dump the database.

According to a July 2013 web application attack report from information security vendor Imperva, SQL injection was the leading type of attack launched against online retailers, which suffered twice as many SQL injection attacks as any other sector. In other industries, the leading attacks against web applications were directory traversal attacks (in 36% of cases), followed by SQL injection (27%) and cross-site scripting (14%).

Alex Holden, CISO at Hold Security, told Krebs that piggybacking on people's browsing was an innovative technique for identifying sites with SQL vulnerabilities, rather than just searching for sites at random. "When you test an application for SQL injection or any other vulnerability, you have a small frame of reference as to the site's functionality," he said. "You often don't know or can't see many user functions. And in some cases you need proper credentials to do it right. In this case, the hackers are using valid requests within many sites that end users themselves are feeding them. This is a much bigger sample than you would normally get."

According to "Kafeine" at the Malware Don't Need Coffee blog, the Advanced Power malware has been distributed at least in part by the Blackhole exploit kit.

On any system infected by Advanced Power malware, the malicious code will attempt to install a Microsoft .NET Framework Assistant add-on -- note that some legitimate applications may also sport that name -- which should trigger a browser warning to install add-ons only from authors whom your trust. The add-on file itself is named "windowsclient.com.xpi."

If the add-on gets installed, the Firefox plug-in then tests almost every page a user to see if it's susceptible to one of several different types of SQL injection attacks. The malware likely then "phones home" to alert the bot herders to the vulnerable site.

According to Holden at Hold Security, Google Translate automatically detected some of the strings used in the malware as being Czech, suggesting that the botnet's owners are either Czech natives or are living in the Czech Republic.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
danielcawrey
50%
50%
danielcawrey,
User Rank: Apprentice
12/16/2013 | 2:12:23 PM
Good information
Nice, informative post about. I especially like the part about SQL injection (not that it's a good thing) and what can be done to try to mitigate the risks.

IT can't possibly cover for every single scenario, but they can at least try to soften the potential damage. 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0993
Published: 2014-09-15
Buffer overflow in the Vcl.Graphics.TPicture.Bitmap implementation in the Visual Component Library (VCL) in Embarcadero Delphi XE6 20.0.15596.9843 and C++ Builder XE6 20.0.15596.9843 allows remote attackers to execute arbitrary code via a crafted BMP file.

CVE-2014-2375
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrary files, and obtain sensitive information or cause a denial of service (disk consumption), via the CSV export feature.

CVE-2014-2376
Published: 2014-09-15
SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2377
Published: 2014-09-15
Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag.

CVE-2014-3077
Published: 2014-09-15
IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant