Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/16/2011
03:45 PM
50%
50%

SMB Websites Face Mass Meshing Attacks

Here's how to protect your SMB website--and what to do if it's been compromised.

12 Money Saving Tech Tips For SMBs
(click image for larger view)
Slideshow: 12 Money Saving Tech Tips For SMBs
Big business and government hacks might get the front-page headlines, but a giant like Citi has the cash to weather a security storm. Not so for small and midsize businesses, especially those that depend on their websites for most of their revenue--a major breach could wipe out the bottom line.

Which makes recent findings by security firm Armorize more alarming. Wayne Huang, the company's chief technology officer, and his team recently starting tracking the latest virulent strain of website infections, which they're calling "mass meshing attacks." SMBs are especially vulnerable.

"It's predominantly SMB websites," Huang said in an interview. "Websites that have decent traffic, but they aren't the Alexa top 500-type of sites like eBay or Amazon."

Huang describes the mass meshing method as an evolution of the longer-standing mass SQL injection. Whereas the latter was a brute-force, hit-or-miss attack, the newer method is much more exact--and potentially much more rewarding for the bad guys. When it's successful, it gives the fraudster much more control because they gain access to the site's administrative credentials and all of its files; Huang called it "fingerprint-level precision."

"Because they can do it at such a precise level, when they attack they don't just inject a single malicious script like in mass SQL injections," Huang said. "They inject a backdoor, which allows them total control of all the files on the website."

Huang added that hackers have gotten better at hiding those backdoors, too, making them harder to find. Similarly, mass meshing creates a bigger headache for security vendors charged with protecting end users from malware. Huang notes that in the past, thousands of mass SQL injections might have all pointed to the same handful of static, malicious domains--easy enough to blacklist. In the case of mass meshing, the infected sites themselves serve as the malicious domains--meaning there might be 20,000 or 30,000 URLs that need to be dealt with. And unlike with actual malicious domains that were never intended for genuine use, it's no longer an add-an-forget blacklist paradigm.

"These are not malicious URLs," Huang said. "These are legitimate websites with loyal customers." The Armorize team has published a detailed breakdown of the threat on their blog.

Such an attack, while not likely to generate the buzz of a breach at the CIA or other high-profile targets, could cripple a smaller business that relies on its website for sales. For starters, an infected site is likely to be blacklisted by Google--a potential deathblow for online businesses--as well as by security vendors, not to mention any software or services that use Google's Safe Browsing API. Even in a less doomsday scenario, a mass meshing infection is likely to damage a business's reputation, particularly if its customers are notified by their browser or antivirus software that its website poses a threat.

"When the website is infected, all of the traffic that [the SMB] has been building up over the years suddenly drops to a very low level," Huang said. "All of a sudden their revenue drops to nearly zero."

The bad news: Huang and his team estimate that there are as many 30,000 websites already infected by mass meshing attacks. The good news: There are of plenty of steps SMBs can take to safeguard their sites without busting their budgets. Huang offers the following advice for keeping your company's website secure against mass meshing attacks:

-- Only use https and sftp protocols to manage and make updates to your site. Using unsecure FTP, in particular, is an open invitation to scammers to sniff out your admin credentials; the default protocol isn't encrypted. "If you do this, you make it much harder [for hackers] even if your PC is infected," Huang said.

 

Recommended Reading:

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...