Asprox botnet launches new wave of SQL injection

The cybercriminals behind Asprox have begun utilising its network of infected computers to carry out SQL injection attacks against vulnerable websites, security firms are warning.

The latest wave of SQL injection attempts emanating from the Asprox botnet began last week, Jason Milletary, counter threat unit security researcher at managed security services vendor SecureWorks, told SCMagazineUS.com.

“Asprox is fairly unsophisticated,” said Gunter Ollmann, vice president of research at enterprise security firm Damballa. “The SQL injection attacks it tries to launch are unsophisticated -- but it works.”

Sometime during last week, Asprox bots began receiving instructions to run an internet search for web applications with vulnerable backend databases that could be susceptible to SQL injection, researchers said. The bots then attempted to inject a malicious IFRAME — or a small piece of HTML code — into these websites.

“All the infected bots are receiving instructions and going and doing that -- running the same Google queries,” Ollmann said. “They get the same results back, so we often see vulnerable websites being attacked and having the malicious IFRAME inserted into their websites multiple times by the same botnet.”

If a user visits one of the compromised websites, the IFRAME causes the user's web browser to be redirected to a distribution site that tries to exploit browser plug-in bugs to install malicious code on the user's system, Milletary said. The goal is to further build the Asprox botnet.

Researchers said they are unsure how many websites have been compromised as a result of this attack. In a similar SQL attack wave from the Asprox botnet last May, more than 2,000 websites were infected.

See original article on scmagazineus.com