Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/11/2013
03:10 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cybercriminals Now Elisting Database Cloud Services

Database-as-a-service supports a new Trojan-based attack that steals businesses' online banking credentials

A new botnet used for stealing commercial online banking credentials relies on database-as-service platforms for command-and-control and storage of stolen booty -- and researchers call it a warning sign of the very real potential for targeted attacks on databases by outside attackers.

The attackers had infected at least 370 machines within five days via a banking Trojan that was discovered and studied by researchers at Imperva while it was under development by the malware creators. The malware connected to a command-and-control server and a dropper server, both of which were cloud-based MSSQL databases. The malware ultimately could be used to directly attack databases as well, the researchers say.

"We believe that there is malware addressing the database specifically. I've been saying this for as long as I've been in this industry, but there was never a sample to catch -- we finally [have] one" with that potential, says Barry Shteiman, director of security strategy at Imperva.

Given that most crimeware today is modular and the main vehicle of the attack is the database connection, the malware easily could be expanded to infect databases as well, according to Imperva.

"[The malware] didn't actually attack the database. But what we see is a trend of the malware being able to connect out of the box; it's modular," says Michael Cherny, Application Defense Center Data Research Team Leader. "It could connect to the local database as well. It's just a matter of the use."

Database breaches typically occur via a malicious user with administrative privileges, or via an infected end user's machine whose privileges are escalated so the attacker can impose his will on the database, Shteiman notes. "But malware with database capabilities changes the game," he says. "All of a sudden, we have virus writers and crimeware kits.

"On premise, IT knows who it gives users to, who is a DBA and who's not, and may restrict as much as possible, where in the cloud that is not even an obstacle to hackers, since they can just register as a 'customer' of the database-as-a-service platform, get a user, and go from there," he says.

Based on their findings, Shteiman and his team believe malware targeting internal enterprise databases will occur "very soon." In a report on the research published today, the security vendor says such an infection is "inevitable, and compromise of a portion of workstations within a network should be considered an inherent condition."

And businesses that host their data with the cloud are at risk. "Due to the exposure of the database to technically savvy attackers and to the ease of obtaining a legitimate foothold on such a server, risk factors are increased. This can quickly be turned into a privilege escalation attack," the report says.

Adrian Lane, analyst and CTO at Securosis, says abusing cloud services for attacks is a natural threat, and database-as-a-service is just another vector for that. "You can spin up cloud instances on demand, using fake or real credit card or debit card accounts, and use them for botnet C&C," for example, he says.

Stored databases typically are not scanned for malicious content, he says, which makes them even more attractive to the bad guys. Nor do many cloud service providers scan their tenants' files for viruses, he says. "Second, using the infected database as a platform makes it more difficult to detect activity as the database is a known process, the activity runs within the database -- making malicious code more difficult to detect. Third, most IDS [intrusion detection system] platforms don't look very closely at app-layer traffic," Lane says.

The new malware discovery by Imperva highlights the inherent dangers of putting sensitive data in the cloud, says Brian Lowans, principal research analyst with Gartner. "What's sensitive that's going into the cloud, and what are the risks of storing that data, who's accessing it, and is the enterprise satisfied with the protection mechanisms in place?" he says.

"This [research] highlights a potential threat of external access by malware. That's always present," Lowans says.

[Independent Oracle Users Group (IOUG) 2013 Enterprise Data Security Survey finds good security practices still a reach goal for the majority of organizations. See 7 Habits Of Highly Secure Database Administrators .]

Since most enterprise database platforms run in the cloud, they could be vulnerable to cloud-borne attacks, Securosis' Lane says. "Keep in mind that most enterprise database platforms run in the cloud -- Oracle, for example -- so they are potentially vulnerable to the same SQL injection and command escalation attacks as normal," he says. "Some, like SQL Azure, are not the same old relational platforms behind the scenes ... the back-end functions are different, so they don't necessarily have any of the same vulnerabilities as on-premises enterprise database servers."

So those attacks with work against enterprise databases running in the cloud, but probably not against databases architected for the cloud, he says.

The full report by Imperva is available here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cbabcock
50%
50%
cbabcock,
User Rank: Apprentice
12/12/2013 | 11:05:00 PM
re: Cybercriminals Now Elisting Database Cloud Services
If malware can lodge itself inside a database system and run its command and control functions there, it will be much harder to detect. This is a dangerous development that the anti-malware forces must address, before database intrusion becomes a more common occurrence. This represents a much more sophisticated threat with drastic consequences if it isn't promptly countered.
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27394
PUBLISHED: 2021-04-16
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications using Mendix 8 (All versions < V8.17.0), Mendix Applications using Mendix 8 (V8.12) (All versions < V8.12.5), Mendix Applications using Mendix 8 (V8.6) (All versions <...
CVE-2020-9667
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction.
CVE-2020-9668
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling symbolic links. An unauthenticated attacker could exploit this to elevate privileges in the context of the current user.
CVE-2020-9681
PUBLISHED: 2021-04-16
Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this to rewrite the file of the administrator, which may lead to elevated permissions. Exploitation of this issue requires user interaction.
CVE-2021-26830
PUBLISHED: 2021-04-16
SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.