Slashdot Mirror
Relentless Web Attack Hard To Kill
ancientribe writes "The thousands of Web sites infected by a new widespread SQL injection attack during the past few days aren't necessarily in the clear after they remove the malicious code from their sites. Researchers from Kaspersky Lab have witnessed the attackers quickly reinfecting those same sites all over again. Meanwhile, researchers at SecureWorks have infiltrated the Chinese underground in an attempt to procure a copy of the stealthy new automated tool being used in the attacks."
Chinkies broked the web. :(
...is NOT the First Post.
It's because of security reports like this, I always recommend Kaspersky security suite over any other anti-virus solution available (free or otherwise). These guys are in the internet-trenches fighting for a more secure internet, and a more secure planet. It is widely known that they are the best in the business. So while many users will try and limp by on free anti-virus, Kaspersky just updated all my computers with protection against these attacks.
The dangers of knowledge trigger emotional distress in human beings.
Relentless, like a nigger asking for a handout?
:P
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
to fixing the hole? It's like fixing a car coolant leak by pouring more water in the radiator.
No colour or religion ever stopped the bullet from a gun
At the end of the day it's the problem of plugins...I mean, besides the fact that the website is being infected, it's the flaws and vulnerabilities of the ActiveX/Browser plugins that allow this kind of activity to be profitable.
Just yet another reason, besides bandwidth, to get Flashblock.
And install as few as browsers plugins/ActiveX as possible.
NoScript is one of the best ways to avoid viruses that are distributed from the web.
SecureWorks: Can I have a copy of your super secret automated tool?
ChineseUnderground: No...
Secureworks... Announcing the fact that you're trying to covertly gain access to these tools rather defeats the point don't you think? It's like going into the ghetto with a sign on your back that says "Undercover Drug Officer". Secureworks, I see two possibilities for this level of stupidity; Management, and your researchers. If by some statistical fluke it was your researchers that had the idea of publicizing this... please have your researchers develop some street smarts and common sense. I don't mean this as a dig at you; This is professional advice... Get them out of the labs and back into the real world and do it now before you really embarass yourself. Now, the more likely answer is someone in management thought this would be a great opportunity for publicity. Shoot them... and use silver bullets. PHBs are notoriously hard to kill.
#fuckbeta #iamslashdot #dicemustdie
Can someone explain to me how websites get infected?
Oh, that's right, running ads and other shit from shady people (directly or indirectly).
I really wish websites would simply stop hosting foreign (not theirs, not trusted, not checked) code and content.
I develop web applications for a living right now and as someone who's only been in this game for a few months, this disgusts me. I already know how to prevent SQL injection with prepared statements. It's easy to do and requires no extra knowledge, so why doesn't everyone do this?
Comment removed based on user account deletion
Not really - but it would be ironic if it was
We had this problem a few months back at work. Old but necessary asp web sites kept getting infected. It only took a few hours to install a reverse proxy with mod_security on EC2 and we were in the clear.
Full story on my blog:
http://guillaume.filion.org/blog/archives/2008/05/i_love_ec2_and_rightscale.php
"The toolkit is protected with a layer of digital rights management and appears to be sold mainly in China. "
this is why I don't believe in "Tusted" computing.
When software or hardware are used to take control of a computer away from that computer's owner bad things will happen.
Is it like Big Trouble in Little China, with the lightning ninjas and floating eye thing? Did they get Kurt Russel to help?
If so, that would be AWESOME.
sudo eat my shorts
Didn't you RTFA? This story is about how Kaspersky caught the attacks... :S
The dangers of knowledge trigger emotional distress in human beings.
Did everyone miss the fact that the toolkit resposible includes some hefty DRM.
Where's the outrage?
Why aren't we demmanding an open source solution?
This is going to sound like a little bit of double speak but I'll remind you that Kaspersky found these attacks were happening. Also, they are studying the behavior. Furthermore, Kaspersky protects systems from nefarious things that attackers will do, regardless of how they get on the system. Nothing is perfect with Windows, but if you look at the options, Kaspersky is the best out there.
Now of course, if you want to insist that the attacks happen whether Kaspersky is running or not, you will be correct. But what you're not saying is how LIMITED the attackers are when trying to get past Kaspersky after they get on a system.
Noscript also helps, but isn't perfect either.
The dangers of knowledge trigger emotional distress in human beings.
Sure! They can block users from nasty ol' Capitolist porn. But, do they keep users from attacking overseas networks? Noooooo.
Sorry. I'm in touch with my inner child today.
Having to work for a living is the root of all evil.
Comment removed based on user account deletion
zsh% apt-cache search kaspersky
zsh%
Your're right to publicise a good product that I also use and reccommend. However:
Most people that get caught by malware don't understand all these arcane details.
Most people use IE, (no noscript here..) and blindly click 'OK' when they cannot see the porn.
Bad web sites / pages don't just install viruses.*
http://xkcd.com/327/
I guess you need to have someone explain it...
"researchers at SecureWorks have infiltrated the Chinese underground in an attempt to procure a copy of the stealthy new automated tool being used in the attacks"
I wish my job description sounded as exciting as this one.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
I keep seeing "SQL injection", but injection into what? PHP? ASP? Plesk? Something else? Specific scripts, or the language engine itself?
For example:
http://www.aqtronix.com/?PageID=99
Presto.. you're safe from sql injection
Governmnent Website Appears To Be Designed Stupid
Part of the Second American Revolution!
If you're going to show off, do it right.
Many continuous distributions are not normally distributed, and no discrete distributions are. So don't understand the 'especially if it is a continuous variable' part. Should be 'only if'.
He said the average, not the median. Sure, for a perfect normal distribution all 3 measures of central tendancy are the same - mean, median & mode. Of course, in real life this never happens.
So the other AC got it right...'fully half if even number' is only right interpretation for all cases.
Meanwhile, your point was?
Okay keep using Noscript. I don't have a problem with that, but be warned that you are not fully protected by Noscript when the website you TRUST is attacked by an exploit like SQL injection, because YOU TRUST THAT WEBSITE.
White-lists are better than no-lists, but they aren't perfect.
The dangers of knowledge trigger emotional distress in human beings.
...roughly half of them being below average, as the OP pointed out.
Thanks all for playing a rousing round of Pageant of Pedants.
I wonder how many of the malicious servers the injected SQL dumped the users into were hosted on McColo - and are thus now not available?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Seriously, SQL Injection is one of the simplest attack vectors to prevent. If you can't prevent SQL injection, you should not be allowed to write a web application.
NoScript is likely to protect you anyway
There's a browser safer than Firefox, it is Firefox, with NoScript
FlashBlock is handy, but not a security tool.
There's a browser safer than Firefox, it is Firefox, with NoScript
He's only half black. He's also half white.
Can somebody clarify this article?? Wtf has SQL got to do with javascript??
And not only that - WHICH SQL server??
I'm guessing its a proprietary one made by a certain large company legendary for their crashware and cheezy interfaces but maybe thats unfair.
Who would know!! IT Journalism standards have dropped through the floor unbelievably.
Devil's advocate... once you have access to the database, you could have root. With root you could host the JS off in the rhubarb on the victim server, where it could be called from within rewritten field data wherever HTML would be expected. On sites like travelocity (one of the targeted websites) this could be anything from the CMS story/article fields to the ad banner code... sky is the limit and that also explains one possible avenue for repeat attacks, post-patch.
Therefore while in SOME CASES, Noscript keeps you safe -- it's not 100%.
The dangers of knowledge trigger emotional distress in human beings.
Comment removed based on user account deletion
Why cant web dev languages (PHP/ASP/Java etc) and databases add language features to A.Make writing database driven web apps the RIGHT way easier than doing it the WRONG way and B.Sanitize database inputs to stop this rogue SQL before it gets run by the database?
Now that you mention it, isn't messing with DRM illegal circumvention?
The Chinese have turned our IP law against us!
Meanwhile, researchers at SecureWorks have infiltrated the Chinese underground in an attempt to procure a copy of the stealthy new automated tool being used in the attacks."
Secureworks needs to buy the tool to figure out how an SQL injection works? Come on, this sounds like just a plug for a vendor. Paying for the tool simply encourages more black market exploit trading rather than proper disclosure methods.
So supposedly patched servers are re-infected? Hint: don't use 'sa' as your password. Secondly, before you get all Gibsonian about "infiltrating the Chinese underground", stop, and think about what you're saying. You sound like a retard.
I want to delete my account but Slashdot doesn't allow it.
Well said. Prepared statements do not solve all problems. Malicious content can be inserted without inserting SQL.
In theory, there's no difference between theory and practice; in practice there is.
Yes, you're right on the fact a targeted attack might inject on-site content which might be allowed by your whitelist, but this is an unlikely scenario, especially in mass attacks like these, because for the attacker is much more practical injecting a small, stealthy inclusion and host the real payload elsewhere, on a server in his full control where he can log the activity and/or mutate the code as needed. Furthermore, you can configure NoScript to execute plugin content (e.g. Flash) on demand (after clicking on a placeholder) on whitelisted sites as well, hugely reducing the attack surface even on trusted pages.
There's a browser safer than Firefox, it is Firefox, with NoScript
I'm inclined to agree. It's not like being asked to write a sorting algorithm that runs in constant time; it's simply not being a lazy moron. Maybe we need to develop a web programming language where string concatenation takes markedly more effort than adding proper parameters to a query.
PHP database connection drivers* will not allow you to execute two SQL statements in one call, effectively limiting the impact of injections to extending the SELECT rather than an INSERT.
Of course, this can still lead to the compromise of admin accounts if you write bad code (which unfortunately covers a lot of PHP code) and "manual" injection from there on.
*Well, I think it's the PHP drivers - it could be just the MySQL/PostgreSQL C drivers that do it. In any case, ASP/MSSQL combo is vulnerable whereas the PHP/MySQL one is not.
Custom HOSTS files are more comprehensive, for one thing, and multiapplication as well as multiplatform for TCPIP.
(They are more comprehensive, in that you blockout bad sites before you can even be stricken by them, and if you can't go into the kitchen, you can't get burned because they cover more than just a single webbrowser, as in the case of NoScript (not a bad thing to have installed in FireFox though, I use it myself, in combination with WOT, FlashBlock, AdBlock Plus, & Perspectives .xpi security addons, no others))
Other browsers (all) like Opera &/or IE are even covered, along with email programs (really, any app that accesses the world-wide web, in fact).
A good custom HOSTS file is featured here and has a good writeup on how to use them as well as maintain them and why:
http://ashentech.com/index.php?topic=1391.msg11023#msg11023
It has a large HOSTS file attached there, updated today in fact (as to known reputable lists as regards known malware or malscript serving websites to block out) from:
STOPBADWARE.ORG
SPYBOT SEARCH AND DESTROY
DANCHO DANCHEV ZDNET SECURITY BLOG
HOSTS FILES FEATURED AT WIKIPEDIA
(All those sources, merged into 1 large 12mb sized HOSTS file (DNS Client service must be stopped to use it, & that saves CPU cycles, RAM, & other forms of I/O since you don't really need it on a single machine connected to the internet), updated regularly each week, fully alphabetized inside and repeat entries removed).
Open it in a text editor like notepad.exe and you will see it is all business, and to the point. Not much in the way of this custom HOSTS file having documentation in it but the URL above provides that as to how to use it for the most part.
The file also speeds you up (beyond its showing you how to speed up access to your favorite websites inside of it, by avoiding DNS calls alone and more or less acting as your own DNS server yourself, via the HOSTS file and possibly some registry hacks to 4 small entries that is very easy to do and the URL above gives accurate directions on how to do so and with the tools you need regedit.exe).
This HOSTS file does so, by blocking out every known adbanner server out there (and by not 'streaming in' yet more unneeded data from other servers for adbanners, as well as running their code burning CPU cycles on it (code that mind you may be compromised and house viruses and spywares, this has been happening the past 3 or 4 years now)) as well as secures you from reliable reputable sources, noted above.
Custom HOSTS files, while in combination with tools like:
NoScript in FireFox (only this browser unfortunately)
Opera's native ability to turn off javascript globally (and make exceptions by site no less via rightclicks on website pages)
Internet Options for IE (turn off javascript)
These, along with a good HOSTS file is an excellent start for an internet defense vs. infestors/infectors.
Supplement HOSTS & the tools noted above, and these:
A good software Firewall program (on that caps both inbound and outbound and notifies you of outbound calls especially)
A good hardware NAT true stateful packet inspecting "firewalling" router
Port filtering
Keeping your OS and apps + drivers patched
Do these things & use those tools, and, you have a better than not chance of staying safe online, if not never infected or compromised, and going faster online as well for a bonus - that's fairly certain.
There is more you need to do, so as hack registry and other configuration files, for really strong security online, but this setup noted is a decent start at least and very easy to implement.
A good overall security guide is here:
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (& beyond):
htt
"researchers at SecureWorks have infiltrated the Chinese underground"
*sigh* God. Damn. That's the funniest thing I've ever read on slashdot.