Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Advanced Power Botnet: Firefox Users, Beware

Malicious Firefox plugin scans websites for exploitable SQL injection vulnerabilities.

Beware a malicious Firefox browser add-on that infects PCs and makes them scan websites for known exploitable vulnerabilities.

The Firefox plugin, which has infected more than 12,500 systems to date, ties into what its developers have dubbed the "Advanced Power" botnet, according to security reporter Brian Krebs, who first reported on the attack campaign.

The add-on has been in circulation since at least May 31, 2013, according to malware analysis service Malwr. When the malware was first spotted, only two out of 47 antivirus engines were recognizing it as malicious code, according to Virus Total. By August 2013, however, 29 out of 45 antivirus scanning engines were flagging the code as malicious.

The malware sports a range of malicious capabilities, including password hijacking and data exfiltration. But those capabilities, at least to date, don't appear to have been activated on compromised -- aka zombie -- PCs that are part of the Advanced Power botnet. Rather, the compromised Windows systems appear to have been used solely to scour the web for sites that are vulnerable to SQL injection attacks.

[Despite Microsoft's earlier claims, the ZeroAccess infrastructure lives on. Read Microsoft Fails To Nuke ZeroAccess Botnet.]

To date, the botnet has reportedly identified 1,800 sites that are vulnerable to its collection of SQL injection attacks.

SQL injection refers to an attack technique that involves inserting malicious SQL statements into database queries -- for example, to dump the entire contents of a database. Such attacks can be blocked using a number of techniques, such as restricting web applications' access to databases, blocking all database inputs except ones that should be received, and encrypting all data stored in the database in case attackers still manage to gain access and dump the database.

According to a July 2013 web application attack report from information security vendor Imperva, SQL injection was the leading type of attack launched against online retailers, which suffered twice as many SQL injection attacks as any other sector. In other industries, the leading attacks against web applications were directory traversal attacks (in 36% of cases), followed by SQL injection (27%) and cross-site scripting (14%).

Alex Holden, CISO at Hold Security, told Krebs that piggybacking on people's browsing was an innovative technique for identifying sites with SQL vulnerabilities, rather than just searching for sites at random. "When you test an application for SQL injection or any other vulnerability, you have a small frame of reference as to the site's functionality," he said. "You often don't know or can't see many user functions. And in some cases you need proper credentials to do it right. In this case, the hackers are using valid requests within many sites that end users themselves are feeding them. This is a much bigger sample than you would normally get."

According to "Kafeine" at the Malware Don't Need Coffee blog, the Advanced Power malware has been distributed at least in part by the Blackhole exploit kit.

On any system infected by Advanced Power malware, the malicious code will attempt to install a Microsoft .NET Framework Assistant add-on -- note that some legitimate applications may also sport that name -- which should trigger a browser warning to install add-ons only from authors whom your trust. The add-on file itself is named "windowsclient.com.xpi."

If the add-on gets installed, the Firefox plug-in then tests almost every page a user to see if it's susceptible to one of several different types of SQL injection attacks. The malware likely then "phones home" to alert the bot herders to the vulnerable site.

According to Holden at Hold Security, Google Translate automatically detected some of the strings used in the malware as being Czech, suggesting that the botnet's owners are either Czech natives or are living in the Czech Republic.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
danielcawrey
50%
50%
danielcawrey,
User Rank: Apprentice
12/16/2013 | 2:12:23 PM
Good information
Nice, informative post about. I especially like the part about SQL injection (not that it's a good thing) and what can be done to try to mitigate the risks.

IT can't possibly cover for every single scenario, but they can at least try to soften the potential damage. 
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.