Security researchers have reported spikes in mass SQL injection attacks of late that take advantage of very common vulnerabilities in the way that Web applications interact with back-end databases. Particularly targeting ASP, ASP.Net, and MS-SQL sites, these mass SQL injection campaigns have been linked to black hat efforts to redirect victims to browser exploit kits like Blackhole or Phoenix.
“There’s been a growing increase on the mass SQL injections side mainly because there is business to be had and money to be made in that area,” says Gunter Ollmann, vice president of research for Damballa. “There are a growing number of professional hackers and crime groups that specialize in quick and rapid identification of websites that are vulnerable to SQL injection, and they monetize that by injecting malicious code normally as part of the pay-per-install or the iFrame injection-type business.”
Unlike traditional SQL injections, which are generally manual attacks seeking to extract data from commerce sites, mass SQL injection attacks are automated, quick-and-dirty attacks that drop malicious code onto the website.
The mass SQL injection model has been prevalent since 2008, with a considerable uptick last spring during the LizaMoon attacks. According to the recent Zscaler ThreatLabz Q1 State of the Web Report, researchers with ThreatLabz noted a spike in LizaMoon activity back in March.
“A year later, we are still seeing this campaign under way, with various peaks and valleys as the attack adapts over time. We noticed that activity picked back up again in March 2012,” the report says.
According to Barnett, the attacks in recent months have a similar M.O., with a slight tweak in the SQL used to conduct the attack.
In April, researchers with F-Secure and Sucuri Security, among others, had brought attention to these attacks, which at that time redirected to the Nikjju.com domain. According to Barnett, malicious activity continues on the back of already injected code, but the domains end users are redirected to remain in flux.
“The infrastructure of what we’re highlighting here is in place, the bad guys are using it — the difference is that all those domains they’re sending them to, those are transient and change almost daily,” he says. “As we put in IP reputation, domain black listing, and all of those things, then people can’t get to those sites, so they have to constantly keep moving. But the infrastructure of exploiting the website and injecting this code, they just keep reusing that until people upgrade their systems.”
That brings us to the mitigation efforts for these attacks.
“One is, first and foremost, they have to stay on top of patching processes. That means knowing what applications you’re running on your servers,” Ollmann says. “And secondly, you need to ensure that your custom applications are designed in a way that even if there is a vulnerability in these back-end systems, that the content is still sanitized and is not projected to visitors of the website.”