Members
  • Total Members: 14176
  • Latest: toxxxa
Stats
  • Total Posts: 42869
  • Total Topics: 16078
  • Online Today: 3461
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)









Author Topic: Ongoing Botnet Attacks Identified as Team Projects (SQL injection, iFrames)  (Read 2267 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


Three significant waves of SQL injection attacks appear to be under the control of the same source, according to one security researcher: http://blog.scansafe.com/journal/2009/8/21/up-to-55k-compromised-by-potent-backdoordata-theft-cocktail.html

Roughly 80,000 Web sites in China, 67,000 in the U.S. and 40,000 in India remain compromised and under botnet control as a result of separate and ongoing SQL injection attacks. The highest infection point during the last three months reached into the millions at one point in China.

The SQL injection attacks have inserted malicious iFrames into legitimate Web sites in order to force visitors off them and onto dangerous malware-laden sites. Mary Landesman, senior security researcher at ScanSafe, says she believes these three waves of SQL injection attacks are likely the handiwork of the same attacker because of the similarity of the domain-name registration information and style of attack.

"It's the thread of the domain names being used," Landesman says. Seven of these "mal-domains" -- a term coined by Landesman to describe domain names used solely to build Internet infrastructure to spread malware or otherwise cause harm -- were registered under the same name and address (which are clearly bogus, being not more than gibberish).

These domain names are now apparently being farmed out across the world as part of the globally distinct attacks in China, U.S. and India.

In this case, the identified domain names were registered using bogus information provided to registrar Go Daddy, which Landesman says is "highly unusual," since Go Daddy has a generally good reputation and attackers typically prefer "domain name providers that turn a blind eye."

Go Daddy was not immediately available to comment.

But the larger problem isn't specific to any one domain-name registrar, it's the way the domain-name registration system has evolved that invites such rampant abuse. "We have a system that allows people to provide completely bogus details about who they are," Landesman says.

The openness of the domain-name registration system and lack of effective oversight has allowed criminals to exploit it to carry out Internet-based crime, she says. "It's not intentionally designed for this kind of abuse, but it works in favor of the criminals."

The system is "broken, and fixing it is the key to cutting down on these attacks," she says.

(PCW)

Samker's Computer Forum - SCforum.info


 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising