Asprox botnet launches new wave of SQL injection

Share this article:
The Asprox botnet has laid low for the first half of the year but the cybercriminals behind it again have begun utilizing its network of infected computers to carry out SQL injection attacks against vulnerable websites, security firms are warning.

The latest wave of SQL injection attempts emanating from the Asprox botnet began last Monday, Jason Milletary, counter threat unit security researcher at managed security services vendor SecureWorks, told SCMagazineUS.com on Tuesday.

“Asprox is fairly unsophisticated,” Gunter Ollmann, vice president of research at enterprise security firm Damballa, told SCMagazineUS.com on Tuesday. “The SQL injection attacks it tries to launch are unsophisticated — but it works.”

Sometime during last week, perhaps as early as Monday, Asprox bots began been receiving instructions to run an internet search for web applications with vulnerable backend databases that potentially are susceptible to SQL injection, researchers said. The bots then attempted to inject a malicious IFRAME — or a small piece of HTML code — into these websites.

“All the infected bots are receiving instructions and going and doing that — running the same Google queries,” Ollmann said. “They get the same results back, so we often see vulnerable websites being attacked and having the malicious IFRAME inserted into their websites multiple times by the same botnet.”

If a user visits one of the compromised websites, the IFRAME causes the user's web browser to be redirected to a distribution site that tries to exploit browser and browser plug-in bugs to install malicious code on the user's system, Milletary said. The goal is to further build the Asprox botnet.

Researchers said they are unsure how many websites have been compromised as a result of this attack. In a similar SQL attack wave from the Asprox botnet last May, more than 2,000 websites were infected.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Adobe exploit used to spread Dyre credential stealer

Adobe exploit used to spread Dyre credential stealer

Users running vulnerable Adobe software could be in danger of having credentials for Bitcoin websites stolen.

Staples is investigating a potential issue involving credit card data

Staples is investigating a potential issue involving credit ...

The company said it is investigating a potential issue involving credit card data and that customers are not responsible for fraudulent activity on cards if an issue is discovered.

Skills set a priority over legacy prejudices, experts say

Skills set a priority over legacy prejudices, experts ...

Cybersecurity expert Winn Schwartau and Robert Clark, a cyber law attorney at the Army Cyber Institute, discussed issues around hiring in the information security industry.