Virus writers go for Olympic gold
Back-ends left open to superbly over-muscled Trojan
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Websites carrying news of the Olympic games have been targeted in a new wave of SQL injection attacks. Vulnerabilities in sites including New Delhi Television Limited's NDTV.com have been booby-trapped with exploits designed to install malware onto users' computers.
NDTV is syndicating AFP’s Olympic content but has failed to secure its back-end databases, leaving the site vulnerable to attack. Other news sites have made similar mistakes, leading hackers to take advantage and push a variant of the Asprox botnet Trojan, net security firm Sophos reports. It adds that failures in setting up servers correctly by client sites, rather than problems with the AFP feed, are the root cause of the problem.
The Asprox attack toolkit has been around for months, but has more recently become associated with a spate of drive-by download attacks that started in May 2008. The tool allows hackers to search for vulnerable websites that allow malicious script to be injected into their content. These scripts typically redirect surfers to sites controlled by hackers that take advantage of browser vulnerabilities and the like to download malware payloads onto vulnerable Windows PCs.
The drive-by download attack method relies on a combination of SQL injection vulnerabilities (or similar) on victimised websites and unpatched Windows clients to spread botnet clients or other form of malware.
F-Secure notes a separate wave of SQL injection attacks targeting Chinese-language websites. Flaws involving the popular Baidu search engine and Flash player are being used to serve up a Trojan design to steal the passwords of online games, it reports.
Olympics hackers going for the big medals are also aiming to ensnare victims using the more traditional method of infected email attachment. Files in circulation posing as a PowerPoint presentation on Olympic venues in Beijing are infected with backdoor code, McAfee warns. Panda Security adds that this malware dials home to a Chinese IP address in order to send back data harvested from infected machines. ®
COMMENTS
@ Geoff Mackenzie
Technically, they are not uploading. Browser exploits don't push bits, they cause the browser to download the code, a client side infection mechanism even if it was server side upon which the initial command to do so was injected a la SQL or some other server vulnerability.
@ John Leyden ...
Have you ever written any commercially successfull software? If not why bite the hand that feeds?
Vulnerable?
It's not true that all PC running Windows are vulnerable. Some of them are switched off.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
