Attacks/Breaches
12/11/2013
03:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Cybercriminals Now Elisting Database Cloud Services

Database-as-a-service supports a new Trojan-based attack that steals businesses' online banking credentials

A new botnet used for stealing commercial online banking credentials relies on database-as-service platforms for command-and-control and storage of stolen booty -- and researchers call it a warning sign of the very real potential for targeted attacks on databases by outside attackers.

The attackers had infected at least 370 machines within five days via a banking Trojan that was discovered and studied by researchers at Imperva while it was under development by the malware creators. The malware connected to a command-and-control server and a dropper server, both of which were cloud-based MSSQL databases. The malware ultimately could be used to directly attack databases as well, the researchers say.

"We believe that there is malware addressing the database specifically. I've been saying this for as long as I've been in this industry, but there was never a sample to catch -- we finally [have] one" with that potential, says Barry Shteiman, director of security strategy at Imperva.

Given that most crimeware today is modular and the main vehicle of the attack is the database connection, the malware easily could be expanded to infect databases as well, according to Imperva.

"[The malware] didn't actually attack the database. But what we see is a trend of the malware being able to connect out of the box; it's modular," says Michael Cherny, Application Defense Center Data Research Team Leader. "It could connect to the local database as well. It's just a matter of the use."

Database breaches typically occur via a malicious user with administrative privileges, or via an infected end user's machine whose privileges are escalated so the attacker can impose his will on the database, Shteiman notes. "But malware with database capabilities changes the game," he says. "All of a sudden, we have virus writers and crimeware kits.

"On premise, IT knows who it gives users to, who is a DBA and who's not, and may restrict as much as possible, where in the cloud that is not even an obstacle to hackers, since they can just register as a 'customer' of the database-as-a-service platform, get a user, and go from there," he says.

Based on their findings, Shteiman and his team believe malware targeting internal enterprise databases will occur "very soon." In a report on the research published today, the security vendor says such an infection is "inevitable, and compromise of a portion of workstations within a network should be considered an inherent condition."

And businesses that host their data with the cloud are at risk. "Due to the exposure of the database to technically savvy attackers and to the ease of obtaining a legitimate foothold on such a server, risk factors are increased. This can quickly be turned into a privilege escalation attack," the report says.

Adrian Lane, analyst and CTO at Securosis, says abusing cloud services for attacks is a natural threat, and database-as-a-service is just another vector for that. "You can spin up cloud instances on demand, using fake or real credit card or debit card accounts, and use them for botnet C&C," for example, he says.

Stored databases typically are not scanned for malicious content, he says, which makes them even more attractive to the bad guys. Nor do many cloud service providers scan their tenants' files for viruses, he says. "Second, using the infected database as a platform makes it more difficult to detect activity as the database is a known process, the activity runs within the database -- making malicious code more difficult to detect. Third, most IDS [intrusion detection system] platforms don't look very closely at app-layer traffic," Lane says.

The new malware discovery by Imperva highlights the inherent dangers of putting sensitive data in the cloud, says Brian Lowans, principal research analyst with Gartner. "What's sensitive that's going into the cloud, and what are the risks of storing that data, who's accessing it, and is the enterprise satisfied with the protection mechanisms in place?" he says.

"This [research] highlights a potential threat of external access by malware. That's always present," Lowans says.

[Independent Oracle Users Group (IOUG) 2013 Enterprise Data Security Survey finds good security practices still a reach goal for the majority of organizations. See 7 Habits Of Highly Secure Database Administrators .]

Since most enterprise database platforms run in the cloud, they could be vulnerable to cloud-borne attacks, Securosis' Lane says. "Keep in mind that most enterprise database platforms run in the cloud -- Oracle, for example -- so they are potentially vulnerable to the same SQL injection and command escalation attacks as normal," he says. "Some, like SQL Azure, are not the same old relational platforms behind the scenes ... the back-end functions are different, so they don't necessarily have any of the same vulnerabilities as on-premises enterprise database servers."

So those attacks with work against enterprise databases running in the cloud, but probably not against databases architected for the cloud, he says.

The full report by Imperva is available here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cbabcock
50%
50%
cbabcock,
User Rank: Apprentice
12/12/2013 | 11:05:00 PM
re: Cybercriminals Now Elisting Database Cloud Services
If malware can lodge itself inside a database system and run its command and control functions there, it will be much harder to detect. This is a dangerous development that the anti-malware forces must address, before database intrusion becomes a more common occurrence. This represents a much more sophisticated threat with drastic consequences if it isn't promptly countered.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7877
Published: 2014-10-30
Unspecified vulnerability in the kernel in HP HP-UX B.11.31 allows local users to cause a denial of service via unknown vectors.

CVE-2014-3051
Published: 2014-10-29
The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28, 7.3 before 7.3.0.1 IF30, and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s...

CVE-2014-3668
Published: 2014-10-29
Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a crafted first argument t...

CVE-2014-3669
Published: 2014-10-29
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function ...

CVE-2014-3670
Published: 2014-10-29
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly exec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.