Mass ASP.NET attack causes websites to turn on visitors
614,000 pages so far in ongoing epidemic
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
An infection that causes poorly configured websites to silently bombard visitors with malware attacks has hit almost 614,000 webpages, Google searches show.
The mass infection, which redirects users to a site exploiting old versions of Oracle's Java, Adobe's Flash player and various browsers, was first disclosed by researchers from Armorize on Wednesday. At the time, it appeared to affect about 180,000 pages. By time of writing on Friday, the initial attack and a follow-on exploit has spread to 613,890 combined pages. The SQL injection attack mostly exploits websites running Microsoft's ASP.Net web application framework.
The infection injects code into websites operated by restaurants, hospitals, and other small businesses and plants an invisible link in visitors' browsers to sites including jjghui.com and nbnjkl.com. Those sites in turn redirected to several other websites that include highly obfuscated code. At the end of the line is a cocktail of attacks that exploit known vulnerabilities in Java and the other targeted programs. Computers running unpatched versions are then commandeered. Servers in the attack used IP addresses based in the US and Russia.
The decoded script generates an iframe to strongdefenseiz.in, which redirects to safetosecurity.rr.nu
When Armorize researchers submitted the code used in the attack on Wednesday, just six of the top 43 antivirus providers detected the attack, according to this VirusTotal analysis. It's unknown if that number has improved since then.
The attack is the latest to force hundreds of thousands of vulnerable webpages to turn against their visitors. An attack in August against machines running the open-source osCommerce web application, for example, poisoned a whopping 8.3 million webpages. Websites used in this week's attack were registered to one James Northone of Plainview, New York, the same registered owner of domains used in the Lizamoon mass-injection attacks in March, which were named after one of the addresses used.
Security firm Sucuri has additional details about the ongoing attack and a scanner that websites can use to check if they're infected here and here. Compromised sites trying to recover must remove the infection from their database and audit their code to rid it of SQL-injection bugs. ®
COMMENTS
The site that this article links to gives a bit more information, but not a lot.
This attack is something that I've seen recently, and it is in fact targeting ASP, but not just ASP. Similar attacks are being conducted against sites using PHP as well.
An overview of how it works:
- Hackers gain entrance to a site, via SQL injection or by some other means. (This may, I believe, involve gaining access to a site on a badly configured shared hosting server and then attacking other sites on that same server.)
- The hackers inject a heavily obfuscated piece of ASP code into .asp files or PHP code into .php files. The injected code is written in such a way that it's very difficult to read.
- When the ASP or PHP code is executed, the malicious routines which have been injected in the code modify the HTML output produced by the code to place a link to a hostile JavaScript on another server.
- This hostile JavaScript is also heavily obfuscated and difficult to read. It opens an invisible iFrame which redirects the user through a series of intermediates to a site which tries a number of different browser exploits to place a drive-by malware executable on the visitor's computer. If this is successful, the newly infected computer phones home to a command and control server.
I first became aware of this attack against ASP and PHP sites while I was investigating a different, unrelated (I believe) attack against WordPress sites that also involves injecting obfuscated PHP code into a compromised Wordpress site. I've written about that attack at
http://tacit.livejournal.com/362704.html
One of the commenters on that blog post mentioned that he had a Web site not using WordPress that was being attacked by the injection of obfuscated PHP code. I took a look to see if it was the same attack. It wasn't...but it was an attack that matches in almost all important regards to this ASP attack.
So I don't think it's really 100% correct to characterize this as an attack on ASP or ASP.NET sites. Rather, what's happening is that sites running vulnerable ASP, ASPX, or PHP code are being exploited; the hackers have written code in both PHP and ASP which, when executed, inserts a call to the malicious JavaScript in the script's output. he similarity of the code and the JavaScript attack at least suggests the possibility that the same people are attacking both ASP and PHP sites.
What an utterly terrible article
How are these websites being compromised?
You say it's SQL injection then go on to say that ASP.Net sites are being targetted - which is it? (Hint: ASP.Net sites can quite happily run without databases)
This article gives me no information to be able to tell whether my servers are vulnerable to attack or not. Pathetic.
very poor
Expect better from an IT site like the reg.
"The infection injects code into websites operated by restaurants, hospitals, and other small businesses"
So that suggests a particular app these places might use is vulnerable, which may or may not be an ASP.NET app. But the headline looks like standard MS bashing fair and suggests the attack is against ASP.NET itself.
Credit to the reg readers that so far there haven't been any tedious derogatory comments about MS (spelled with the dollar site, naturally) urging man and dog to adopt open source O/Ss to avoid such issues.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
