Attacks/Breaches
7/14/2010
11:59 PM
Tim Wilson
Tim Wilson
Quick Hits
50%
50%

Researchers: Asprox Botnet Is Resurging

Spambot infected more than 10,000 service providers in three days, M86 study says

The botnet Asprox, long known for its spamming capabilities, resurged last month, according to a new first-half lab report by M86 Security.

Asprox, which also uses SQL injection techniques to infect vulnerable application service provider (ASP) sites on a large scale, showed a large spike in activity in June, infecting more than 10,000 ASPs in a three-day period, M86 says. The bot downloads instructions, which include target ASP websites, and then performs an SQL injection attack that attempts to poison data in the underlying SQL database serving the site.

Interestingly, the botnet used a simple Google search to seek out additional vulnerable ASP sites, M86 says.

Asprox is typical of the new breed of combined attacks that grew significantly in the first half of 2010, according to the report, which outlines a number of trends in spam and malware.

"Traditional methods [of attack], such as spambots and dynamic code obfuscation, are still very much in use," said Bradley Anstis, vice president of technology strategy at M86 Security. "However, the first half of 2010 has also seen the emergence of new, advanced methods -- as seen in the new combined attacks. Cybercriminals continue to try and outsmart even the latest Internet security protection mechanisms."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

CVE-2014-6080
Published: 2014-12-18
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.