Attacks/Breaches
12/11/2013
03:10 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

Cybercriminals Now Elisting Database Cloud Services

Database-as-a-service supports a new Trojan-based attack that steals businesses' online banking credentials

A new botnet used for stealing commercial online banking credentials relies on database-as-service platforms for command-and-control and storage of stolen booty -- and researchers call it a warning sign of the very real potential for targeted attacks on databases by outside attackers.

The attackers had infected at least 370 machines within five days via a banking Trojan that was discovered and studied by researchers at Imperva while it was under development by the malware creators. The malware connected to a command-and-control server and a dropper server, both of which were cloud-based MSSQL databases. The malware ultimately could be used to directly attack databases as well, the researchers say.

"We believe that there is malware addressing the database specifically. I've been saying this for as long as I've been in this industry, but there was never a sample to catch -- we finally [have] one" with that potential, says Barry Shteiman, director of security strategy at Imperva.

Given that most crimeware today is modular and the main vehicle of the attack is the database connection, the malware easily could be expanded to infect databases as well, according to Imperva.

"[The malware] didn't actually attack the database. But what we see is a trend of the malware being able to connect out of the box; it's modular," says Michael Cherny, Application Defense Center Data Research Team Leader. "It could connect to the local database as well. It's just a matter of the use."

Database breaches typically occur via a malicious user with administrative privileges, or via an infected end user's machine whose privileges are escalated so the attacker can impose his will on the database, Shteiman notes. "But malware with database capabilities changes the game," he says. "All of a sudden, we have virus writers and crimeware kits.

"On premise, IT knows who it gives users to, who is a DBA and who's not, and may restrict as much as possible, where in the cloud that is not even an obstacle to hackers, since they can just register as a 'customer' of the database-as-a-service platform, get a user, and go from there," he says.

Based on their findings, Shteiman and his team believe malware targeting internal enterprise databases will occur "very soon." In a report on the research published today, the security vendor says such an infection is "inevitable, and compromise of a portion of workstations within a network should be considered an inherent condition."

And businesses that host their data with the cloud are at risk. "Due to the exposure of the database to technically savvy attackers and to the ease of obtaining a legitimate foothold on such a server, risk factors are increased. This can quickly be turned into a privilege escalation attack," the report says.

Adrian Lane, analyst and CTO at Securosis, says abusing cloud services for attacks is a natural threat, and database-as-a-service is just another vector for that. "You can spin up cloud instances on demand, using fake or real credit card or debit card accounts, and use them for botnet C&C," for example, he says.

Stored databases typically are not scanned for malicious content, he says, which makes them even more attractive to the bad guys. Nor do many cloud service providers scan their tenants' files for viruses, he says. "Second, using the infected database as a platform makes it more difficult to detect activity as the database is a known process, the activity runs within the database -- making malicious code more difficult to detect. Third, most IDS [intrusion detection system] platforms don't look very closely at app-layer traffic," Lane says.

The new malware discovery by Imperva highlights the inherent dangers of putting sensitive data in the cloud, says Brian Lowans, principal research analyst with Gartner. "What's sensitive that's going into the cloud, and what are the risks of storing that data, who's accessing it, and is the enterprise satisfied with the protection mechanisms in place?" he says.

"This [research] highlights a potential threat of external access by malware. That's always present," Lowans says.

[Independent Oracle Users Group (IOUG) 2013 Enterprise Data Security Survey finds good security practices still a reach goal for the majority of organizations. See 7 Habits Of Highly Secure Database Administrators .]

Since most enterprise database platforms run in the cloud, they could be vulnerable to cloud-borne attacks, Securosis' Lane says. "Keep in mind that most enterprise database platforms run in the cloud -- Oracle, for example -- so they are potentially vulnerable to the same SQL injection and command escalation attacks as normal," he says. "Some, like SQL Azure, are not the same old relational platforms behind the scenes ... the back-end functions are different, so they don't necessarily have any of the same vulnerabilities as on-premises enterprise database servers."

So those attacks with work against enterprise databases running in the cloud, but probably not against databases architected for the cloud, he says.

The full report by Imperva is available here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cbabcock
50%
50%
cbabcock,
User Rank: Apprentice
12/12/2013 | 11:05:00 PM
re: Cybercriminals Now Elisting Database Cloud Services
If malware can lodge itself inside a database system and run its command and control functions there, it will be much harder to detect. This is a dangerous development that the anti-malware forces must address, before database intrusion becomes a more common occurrence. This represents a much more sophisticated threat with drastic consequences if it isn't promptly countered.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3154
Published: 2014-04-17
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file conte...

CVE-2013-2143
Published: 2014-04-17
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

CVE-2014-0036
Published: 2014-04-17
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

CVE-2014-0054
Published: 2014-04-17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External ...

CVE-2014-0071
Published: 2014-04-17
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Best of the Web