12:22 PM

Advanced Power Botnet: Firefox Users, Beware

Malicious Firefox plugin scans websites for exploitable SQL injection vulnerabilities.

Beware a malicious Firefox browser add-on that infects PCs and makes them scan websites for known exploitable vulnerabilities.

The Firefox plugin, which has infected more than 12,500 systems to date, ties into what its developers have dubbed the "Advanced Power" botnet, according to security reporter Brian Krebs, who first reported on the attack campaign.

The add-on has been in circulation since at least May 31, 2013, according to malware analysis service Malwr. When the malware was first spotted, only two out of 47 antivirus engines were recognizing it as malicious code, according to Virus Total. By August 2013, however, 29 out of 45 antivirus scanning engines were flagging the code as malicious.

The malware sports a range of malicious capabilities, including password hijacking and data exfiltration. But those capabilities, at least to date, don't appear to have been activated on compromised -- aka zombie -- PCs that are part of the Advanced Power botnet. Rather, the compromised Windows systems appear to have been used solely to scour the web for sites that are vulnerable to SQL injection attacks.

[Despite Microsoft's earlier claims, the ZeroAccess infrastructure lives on. Read Microsoft Fails To Nuke ZeroAccess Botnet.]

To date, the botnet has reportedly identified 1,800 sites that are vulnerable to its collection of SQL injection attacks.

SQL injection refers to an attack technique that involves inserting malicious SQL statements into database queries -- for example, to dump the entire contents of a database. Such attacks can be blocked using a number of techniques, such as restricting web applications' access to databases, blocking all database inputs except ones that should be received, and encrypting all data stored in the database in case attackers still manage to gain access and dump the database.

According to a July 2013 web application attack report from information security vendor Imperva, SQL injection was the leading type of attack launched against online retailers, which suffered twice as many SQL injection attacks as any other sector. In other industries, the leading attacks against web applications were directory traversal attacks (in 36% of cases), followed by SQL injection (27%) and cross-site scripting (14%).

Alex Holden, CISO at Hold Security, told Krebs that piggybacking on people's browsing was an innovative technique for identifying sites with SQL vulnerabilities, rather than just searching for sites at random. "When you test an application for SQL injection or any other vulnerability, you have a small frame of reference as to the site's functionality," he said. "You often don't know or can't see many user functions. And in some cases you need proper credentials to do it right. In this case, the hackers are using valid requests within many sites that end users themselves are feeding them. This is a much bigger sample than you would normally get."

According to "Kafeine" at the Malware Don't Need Coffee blog, the Advanced Power malware has been distributed at least in part by the Blackhole exploit kit.

On any system infected by Advanced Power malware, the malicious code will attempt to install a Microsoft .NET Framework Assistant add-on -- note that some legitimate applications may also sport that name -- which should trigger a browser warning to install add-ons only from authors whom your trust. The add-on file itself is named ""

If the add-on gets installed, the Firefox plug-in then tests almost every page a user to see if it's susceptible to one of several different types of SQL injection attacks. The malware likely then "phones home" to alert the bot herders to the vulnerable site.

According to Holden at Hold Security, Google Translate automatically detected some of the strings used in the malware as being Czech, suggesting that the botnet's owners are either Czech natives or are living in the Czech Republic.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)


Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Apprentice
12/16/2013 | 2:12:23 PM
Good information
Nice, informative post about. I especially like the part about SQL injection (not that it's a good thing) and what can be done to try to mitigate the risks.

IT can't possibly cover for every single scenario, but they can at least try to soften the potential damage. 
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio