Attacks/Breaches
12/16/2013
12:22 PM
50%
50%

Advanced Power Botnet: Firefox Users, Beware

Malicious Firefox plugin scans websites for exploitable SQL injection vulnerabilities.

Beware a malicious Firefox browser add-on that infects PCs and makes them scan websites for known exploitable vulnerabilities.

The Firefox plugin, which has infected more than 12,500 systems to date, ties into what its developers have dubbed the "Advanced Power" botnet, according to security reporter Brian Krebs, who first reported on the attack campaign.

The add-on has been in circulation since at least May 31, 2013, according to malware analysis service Malwr. When the malware was first spotted, only two out of 47 antivirus engines were recognizing it as malicious code, according to Virus Total. By August 2013, however, 29 out of 45 antivirus scanning engines were flagging the code as malicious.

The malware sports a range of malicious capabilities, including password hijacking and data exfiltration. But those capabilities, at least to date, don't appear to have been activated on compromised -- aka zombie -- PCs that are part of the Advanced Power botnet. Rather, the compromised Windows systems appear to have been used solely to scour the web for sites that are vulnerable to SQL injection attacks.

[Despite Microsoft's earlier claims, the ZeroAccess infrastructure lives on. Read Microsoft Fails To Nuke ZeroAccess Botnet.]

To date, the botnet has reportedly identified 1,800 sites that are vulnerable to its collection of SQL injection attacks.

SQL injection refers to an attack technique that involves inserting malicious SQL statements into database queries -- for example, to dump the entire contents of a database. Such attacks can be blocked using a number of techniques, such as restricting web applications' access to databases, blocking all database inputs except ones that should be received, and encrypting all data stored in the database in case attackers still manage to gain access and dump the database.

According to a July 2013 web application attack report from information security vendor Imperva, SQL injection was the leading type of attack launched against online retailers, which suffered twice as many SQL injection attacks as any other sector. In other industries, the leading attacks against web applications were directory traversal attacks (in 36% of cases), followed by SQL injection (27%) and cross-site scripting (14%).

Alex Holden, CISO at Hold Security, told Krebs that piggybacking on people's browsing was an innovative technique for identifying sites with SQL vulnerabilities, rather than just searching for sites at random. "When you test an application for SQL injection or any other vulnerability, you have a small frame of reference as to the site's functionality," he said. "You often don't know or can't see many user functions. And in some cases you need proper credentials to do it right. In this case, the hackers are using valid requests within many sites that end users themselves are feeding them. This is a much bigger sample than you would normally get."

According to "Kafeine" at the Malware Don't Need Coffee blog, the Advanced Power malware has been distributed at least in part by the Blackhole exploit kit.

On any system infected by Advanced Power malware, the malicious code will attempt to install a Microsoft .NET Framework Assistant add-on -- note that some legitimate applications may also sport that name -- which should trigger a browser warning to install add-ons only from authors whom your trust. The add-on file itself is named "windowsclient.com.xpi."

If the add-on gets installed, the Firefox plug-in then tests almost every page a user to see if it's susceptible to one of several different types of SQL injection attacks. The malware likely then "phones home" to alert the bot herders to the vulnerable site.

According to Holden at Hold Security, Google Translate automatically detected some of the strings used in the malware as being Czech, suggesting that the botnet's owners are either Czech natives or are living in the Czech Republic.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
danielcawrey
50%
50%
danielcawrey,
User Rank: Apprentice
12/16/2013 | 2:12:23 PM
Good information
Nice, informative post about. I especially like the part about SQL injection (not that it's a good thing) and what can be done to try to mitigate the risks.

IT can't possibly cover for every single scenario, but they can at least try to soften the potential damage. 
1.9 Billion Data Records Exposed in First Half of 2017
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/20/2017
To Be Ready for the Security Future, Pay Attention to the Security Past
Liz Maida, Co-founder, CEO & CTO, Uplevel Security,  9/18/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Jan, check this out! I found an unhackable PC.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.