Attacks/Breaches
12/11/2013
03:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Cybercriminals Now Elisting Database Cloud Services

Database-as-a-service supports a new Trojan-based attack that steals businesses' online banking credentials

A new botnet used for stealing commercial online banking credentials relies on database-as-service platforms for command-and-control and storage of stolen booty -- and researchers call it a warning sign of the very real potential for targeted attacks on databases by outside attackers.

The attackers had infected at least 370 machines within five days via a banking Trojan that was discovered and studied by researchers at Imperva while it was under development by the malware creators. The malware connected to a command-and-control server and a dropper server, both of which were cloud-based MSSQL databases. The malware ultimately could be used to directly attack databases as well, the researchers say.

"We believe that there is malware addressing the database specifically. I've been saying this for as long as I've been in this industry, but there was never a sample to catch -- we finally [have] one" with that potential, says Barry Shteiman, director of security strategy at Imperva.

Given that most crimeware today is modular and the main vehicle of the attack is the database connection, the malware easily could be expanded to infect databases as well, according to Imperva.

"[The malware] didn't actually attack the database. But what we see is a trend of the malware being able to connect out of the box; it's modular," says Michael Cherny, Application Defense Center Data Research Team Leader. "It could connect to the local database as well. It's just a matter of the use."

Database breaches typically occur via a malicious user with administrative privileges, or via an infected end user's machine whose privileges are escalated so the attacker can impose his will on the database, Shteiman notes. "But malware with database capabilities changes the game," he says. "All of a sudden, we have virus writers and crimeware kits.

"On premise, IT knows who it gives users to, who is a DBA and who's not, and may restrict as much as possible, where in the cloud that is not even an obstacle to hackers, since they can just register as a 'customer' of the database-as-a-service platform, get a user, and go from there," he says.

Based on their findings, Shteiman and his team believe malware targeting internal enterprise databases will occur "very soon." In a report on the research published today, the security vendor says such an infection is "inevitable, and compromise of a portion of workstations within a network should be considered an inherent condition."

And businesses that host their data with the cloud are at risk. "Due to the exposure of the database to technically savvy attackers and to the ease of obtaining a legitimate foothold on such a server, risk factors are increased. This can quickly be turned into a privilege escalation attack," the report says.

Adrian Lane, analyst and CTO at Securosis, says abusing cloud services for attacks is a natural threat, and database-as-a-service is just another vector for that. "You can spin up cloud instances on demand, using fake or real credit card or debit card accounts, and use them for botnet C&C," for example, he says.

Stored databases typically are not scanned for malicious content, he says, which makes them even more attractive to the bad guys. Nor do many cloud service providers scan their tenants' files for viruses, he says. "Second, using the infected database as a platform makes it more difficult to detect activity as the database is a known process, the activity runs within the database -- making malicious code more difficult to detect. Third, most IDS [intrusion detection system] platforms don't look very closely at app-layer traffic," Lane says.

The new malware discovery by Imperva highlights the inherent dangers of putting sensitive data in the cloud, says Brian Lowans, principal research analyst with Gartner. "What's sensitive that's going into the cloud, and what are the risks of storing that data, who's accessing it, and is the enterprise satisfied with the protection mechanisms in place?" he says.

"This [research] highlights a potential threat of external access by malware. That's always present," Lowans says.

[Independent Oracle Users Group (IOUG) 2013 Enterprise Data Security Survey finds good security practices still a reach goal for the majority of organizations. See 7 Habits Of Highly Secure Database Administrators .]

Since most enterprise database platforms run in the cloud, they could be vulnerable to cloud-borne attacks, Securosis' Lane says. "Keep in mind that most enterprise database platforms run in the cloud -- Oracle, for example -- so they are potentially vulnerable to the same SQL injection and command escalation attacks as normal," he says. "Some, like SQL Azure, are not the same old relational platforms behind the scenes ... the back-end functions are different, so they don't necessarily have any of the same vulnerabilities as on-premises enterprise database servers."

So those attacks with work against enterprise databases running in the cloud, but probably not against databases architected for the cloud, he says.

The full report by Imperva is available here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cbabcock
50%
50%
cbabcock,
User Rank: Apprentice
12/12/2013 | 11:05:00 PM
re: Cybercriminals Now Elisting Database Cloud Services
If malware can lodge itself inside a database system and run its command and control functions there, it will be much harder to detect. This is a dangerous development that the anti-malware forces must address, before database intrusion becomes a more common occurrence. This represents a much more sophisticated threat with drastic consequences if it isn't promptly countered.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5110
Published: 2014-08-29
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVE-2012-1503
Published: 2014-08-29
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

CVE-2013-5467
Published: 2014-08-29
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM)...

CVE-2014-0600
Published: 2014-08-29
FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287.

CVE-2014-0888
Published: 2014-08-29
IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.