Database Trojan infests pro-Tibet websites
Chinese whispers
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Security researchers have unearthed more details about a Trojan that targets backend databases as well as desktop clients.
The Fribet Trojan has been planted on pro-Tibet websites, possibly using a Vector Markup Language flaw (MS07-004) patched by Microsoft early last year. When visitors to the pro-Tibet websites are infected, the Fribet Trojan creates a backdoor on compromised hosts.
In addition, the Trojan loads a "SQL Native Client" ODBC library that's designed to execute arbitrary SQL statements received from a command and control server. The feature provides the ability to run arbitrary SQL commands from compromised machines onto connected database servers. This functionality allows hackers to steal data or modify databases, providing they are able to log onto these databases in the first place.
The attacker still needs to find out the host name, database name, username and password. However, monitoring functions included with Fribet as well as easily-guessable weak and default values might leave the door open for hackers, net security firm McAfee reports.
The Fribet Trojan emerges little more than a month after SQL injection attacks, which inserted iFrame links to sites hosting exploit scripts and malware on legitimate websites.
Unlike those attacks, the Fribet Trojan can be used against the attack sites protected against conventional SQL injection attacks. McAfee researchers Shinsuke Honjo and Geok Meng Ong explain.
"This Trojan apparently can be used as an alternate to SQL Injection attacks, but in a more direct way," they write. "Even the administrators of secure web sites, protected against common SQL injection attacks, should ensure database backends are equally secure to defend against such a penetration vector." ®
COMMENTS
@Reto Egeter
"I think your propaganda is showing. A lot of innocent minorities have died in Tibet because the Police did not want to use force for a full 2-3 Days (because of world opionon). Thank you for standing by the side of murderes with a smug face asshole."
A lot of innocent people have died in Tibet ever since China decided they want to occupy that country. The Chinese police would not need to use any force at all if they simply weren't there.
Current Affairs
I guess the criminals read the papers, watch the news and predit where the world will be browsing next.
Often there is the "Support PeopleX after DisasterY "sites that gets thrown up quickly whenever there is an earthquake/landslide/starving crisis that gives out news or asks for aid. Probably set up with little finances and older software and not fully patched.
Target where your prospective audience will be going and get there early.
I suspect all new aid sites are targetted in this way...
Of course Paris knows what it's like to be targetted. What's the betting that www.picsoffparisphone08.com has its own cute pink trojan
Standardized LART
Let's see... Windows exploit, patched more than a year ago...
...citing a computer security firm who knew about the problem more than a year ago...
...accusations of Chinese hackers, even though the quoted computer security firm admits to sending virus tech to China...
Yep, sounds like a standardized IT security article to me.
Troll meter : 8/10 (Them little increasingly expensive dolls), BS meter: 6/10 (We're here to protect you), Flame meter: 0 (paper bag full of hot air).
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
