Attacks/Breaches
12/16/2013
12:22 PM
Connect Directly
RSS
E-Mail
50%
50%

Advanced Power Botnet: Firefox Users, Beware

Malicious Firefox plugin scans websites for exploitable SQL injection vulnerabilities.

Beware a malicious Firefox browser add-on that infects PCs and makes them scan websites for known exploitable vulnerabilities.

The Firefox plugin, which has infected more than 12,500 systems to date, ties into what its developers have dubbed the "Advanced Power" botnet, according to security reporter Brian Krebs, who first reported on the attack campaign.

The add-on has been in circulation since at least May 31, 2013, according to malware analysis service Malwr. When the malware was first spotted, only two out of 47 antivirus engines were recognizing it as malicious code, according to Virus Total. By August 2013, however, 29 out of 45 antivirus scanning engines were flagging the code as malicious.

The malware sports a range of malicious capabilities, including password hijacking and data exfiltration. But those capabilities, at least to date, don't appear to have been activated on compromised -- aka zombie -- PCs that are part of the Advanced Power botnet. Rather, the compromised Windows systems appear to have been used solely to scour the web for sites that are vulnerable to SQL injection attacks.

[Despite Microsoft's earlier claims, the ZeroAccess infrastructure lives on. Read Microsoft Fails To Nuke ZeroAccess Botnet.]

To date, the botnet has reportedly identified 1,800 sites that are vulnerable to its collection of SQL injection attacks.

SQL injection refers to an attack technique that involves inserting malicious SQL statements into database queries -- for example, to dump the entire contents of a database. Such attacks can be blocked using a number of techniques, such as restricting web applications' access to databases, blocking all database inputs except ones that should be received, and encrypting all data stored in the database in case attackers still manage to gain access and dump the database.

According to a July 2013 web application attack report from information security vendor Imperva, SQL injection was the leading type of attack launched against online retailers, which suffered twice as many SQL injection attacks as any other sector. In other industries, the leading attacks against web applications were directory traversal attacks (in 36% of cases), followed by SQL injection (27%) and cross-site scripting (14%).

Alex Holden, CISO at Hold Security, told Krebs that piggybacking on people's browsing was an innovative technique for identifying sites with SQL vulnerabilities, rather than just searching for sites at random. "When you test an application for SQL injection or any other vulnerability, you have a small frame of reference as to the site's functionality," he said. "You often don't know or can't see many user functions. And in some cases you need proper credentials to do it right. In this case, the hackers are using valid requests within many sites that end users themselves are feeding them. This is a much bigger sample than you would normally get."

According to "Kafeine" at the Malware Don't Need Coffee blog, the Advanced Power malware has been distributed at least in part by the Blackhole exploit kit.

On any system infected by Advanced Power malware, the malicious code will attempt to install a Microsoft .NET Framework Assistant add-on -- note that some legitimate applications may also sport that name -- which should trigger a browser warning to install add-ons only from authors whom your trust. The add-on file itself is named "windowsclient.com.xpi."

If the add-on gets installed, the Firefox plug-in then tests almost every page a user to see if it's susceptible to one of several different types of SQL injection attacks. The malware likely then "phones home" to alert the bot herders to the vulnerable site.

According to Holden at Hold Security, Google Translate automatically detected some of the strings used in the malware as being Czech, suggesting that the botnet's owners are either Czech natives or are living in the Czech Republic.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
danielcawrey
50%
50%
danielcawrey,
User Rank: Apprentice
12/16/2013 | 2:12:23 PM
Good information
Nice, informative post about. I especially like the part about SQL injection (not that it's a good thing) and what can be done to try to mitigate the risks.

IT can't possibly cover for every single scenario, but they can at least try to soften the potential damage. 
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.