New Botnet Malware Spreading SQL Injection Attack Tool

Keep on Guard!


Now this is an interesting turn of events, the Asprox botnet malware is being used to spread SQL Injection tools rather than sending out phishing e-mails as before.

It seems to install quite stealthily as well disguising itself as a Windows Service with a fairly convincing file name. It’s certainly interesting to see the evolution of this kind of malware, what will be next?

A botnet is outfitting its army of compromised computers with a SQL injection attack tool to hack Web sites, researchers at SecureWorks have discovered.

According to SecureWorks, the Asprox botnet, once used solely to send out phishing e-mails, is pushing the tool out to systems in its network via a binary with the file name msscntr32.exe. The executable is installed as a system service with the name “Microsoft Security Center Extension.”

Despite the name, the file is in fact a SQL injection attack tool that when launched searches Google for .asp pages that contain certain terms. It then launches SQL injection attacks against the Web sites returned by the search.

The bad news is not many AV vendors are detecting it yet, it seems like it’s just another avenue or infection vector for the Asprox malware. It injects an iFrame into vulnerable pages which will lead to the download of the Asprox infector.

Storm did a variation of this as mentioned via FTP.

According to a list from VirusTotal, only a handful of the major anti-virus vendors are detecting the attack tool at this time.

“This is the first time I’ve seen a SQL injection tool, but certainly other botnets have tried to spread in a similar manner, infecting Web sites with IFrames,” said Joe Stewart, director of malware research at SecureWorks. “For instance, Storm tries to get your password if you log in to a Web site with FTP, and will put an IFrame into the page for you.”

So far, SecureWorks has found 1,000 Web sites infected by this wave of SQL attacks. Visitors to these infected Web sites are infected with the Asprox malware—turning them into bots—and also download some scareware.

It seems like a fairly small scale infection for now, but it’s definitely a worrying trend. It seems like the bad guys are definitely keeping up with the latest vulnerabilities in web apps and online languages and they are utilizing them to spread their wares.

Source: eWeek

Posted in: Malware, Web Hacking

, , , , , , , ,


Latest Posts:


BootStomp - Find Bootloader Vulnerabilities BootStomp – Find Android Bootloader Vulnerabilities
BootStomp is a Python-based tool, with Docker support that helps you find two different classes of bootloader vulnerabilities and bugs.
Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018 Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018
Google is ramping up its campaign against HTTP only sites and is going to mark ALL Non-HTTPS sites insecure in July 2018 with the release of Chrome 68.
altdns - Subdomain Recon Tool With Permutation Generation altdns – Subdomain Recon Tool With Permutation Generation
Altdns is a subdomain recon tool in Python that allows for the discovery of subdomains that conform to patterns. The tool takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.
0-Day Flash Vulnerability Exploited In The Wild 0-Day Flash Vulnerability Exploited In The Wild
So another 0-Day Flash Vulnerability is being exploited in the Wild, a previously unknown flaw which has been labelled CVE-2018-4878 and it affects 28.0.0.137 and earlier versions
dorkbot - Command-Line Tool For Google Dorking dorkbot – Command-Line Tool For Google Dorking
dorkbot is a modular command-line tool for Google dorking, which is performing vulnerability scans against a set of web pages returned by Google search queries in a given Google Custom Search Engine.
USBPcap - USB Packet Capture For Windows USBPcap – USB Packet Capture For Windows
USBPcap is an open-source USB Packet Capture tool for Windows that can be used together with Wireshark in order to analyse USB traffic without using a Virtual Machine.


8 Responses to New Botnet Malware Spreading SQL Injection Attack Tool

  1. eM3rC May 16, 2008 at 12:01 am #

    When I first found out about botnets I though it was an amazing concept.

    Not that their being used to distribute files a whole new market of exploiting has just opened. I wonder what the next step is.

  2. 1337ullus May 16, 2008 at 7:13 am #

    Actually, it’s real pain to get protected against the botnets. We’ve been and are still beeing attacked by Storm, that is (re)injecting ftp sites every friday or so. The sql injection ome stroke once on may 1st..

    We built an authpf bridge that let you ftp in only if you connected your website first. Hope it’ll stop Storm for a while.
    As for the sql injections, we had to fix a lot of scripts…

    I wonder if there are dnsbl that report botnet infected hosts ..

  3. zupakomputer May 16, 2008 at 4:05 pm #

    That’s what happens though, when anything gets complicated (like webpage coding, and database coding) then it becomes a haven for being able to hide all kinds of activity in.

    And personally, I really think that the over-complicated coding is pushed for exactly those reasons. Same way they do that in the law and in any kinds of bureacracies, it’s ordered in such a way that no-one can ever know all of it, and there’s loads of avenues to exploit things through.

    Keep things simple and straightforward, and it’s easy to see who’s doing what and where they are doing it.

  4. 1337ullus May 19, 2008 at 9:02 am #

    Look like the injection code use an open source librairy from http://www.indyproject.org/.

    Last week-end attack queries contained : “User-agent: Mozilla/3.0 (compatible; Indy Library).”

  5. Bogwitch May 19, 2008 at 11:54 am #

    @1337ullus,

    “We

  6. Jinesh May 19, 2008 at 1:42 pm #

    These botnets are scarry. One which i had on my machine used to upload files on torrent. weird huh!!!

  7. 1337ullus May 20, 2008 at 4:48 pm #

    @Bogwitch
    No bug to patch in the FTP issue, here is the story:

    Afaik, our customers got infected. The botnet agent either sniff ftp user/pass from network or use well known ftp client config file (filezilla), and send the FTP account to the botnet.

    The botnet then connect with the stolen FTP account and modify specific files (index, js, …) to inject javascripts (trojan downloader).

    New customers get infected while browsing infected websites and botnet life goes on.

    I agree that solution to FTP problem is not to use FTP anymore.
    BUT we got thousands customers accustomed to use FTP with their favorite FTP Client. Then MS secured ftp is … inexistant.
    Also we did change FTP user/pass, but it’s useless as long as customers are infected.

    We also setted blacklists on attackers ip classes, but as fast as it goes, we’ll be blacklisting the whole internet next week.

    The FTP authpf bridge was setted up last week, then the SQL Injection attack stroke. I’ll give you stats of my bridge later.

  8. Bogwitch May 20, 2008 at 7:05 pm #

    1337ullus,

    Thanks for clarifying that for me. interesting problem.