LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites
Websense has been tracking a mass SQL-Injection attack for the past few days that started with only a few ten thousand websites and has exploded to potentially over 1 million websites. There doesn't seem to be anything particularly new about the infection mechanism (aside of the scope of its success) and the injection itself only inserts a random snippet of HTML to redirect victims to a rogue AV site that tells the user they are infected.
One of the domains implicated in this attack was registered in October and showed up on the radar in December, so it appears the preparation of this attack has taken some time and it's been perculating for awhile. The bulk of the infections, however, have only just occurred in the last few days. Infected sites tend to use the same URL structure including a file "ur.php". It appears this is only affecting sites using Microsoft SQL Server 2003/2005.
Defense against your sites getting infected is the standard things we ought to be doing anyway in regards to SQL injection (i.e.use prepared statements, filter input for control characters, whitelist if possible, blocklist if not). Webserver administrators should also be checking for sudden appearance of files in their httpdocs directory. More on this as it develops.
--
John Bambenek
bambenek at gmail /dot/ com
Bambenek Consulting
Comments
1. Validate input with a whitelist
2. Use only parameterized SQL queries
3. HTML encode data sent to the browser
While it is a good practice in general, I don't think checking httpdocs for unusual files would help here since the injected attack code is coming from the database.
Buckaroo Banzai
Apr 1st 2011
1 decade ago
Alan
Apr 2nd 2011
1 decade ago
Adam
Apr 2nd 2011
1 decade ago
"Q: How do you know it's using SQL Injection?
A: We have been contacted by people who have seen the code in their Microsoft SQL databases. Initially we only received reports of users running Microsoft SQL Server 2000 and 2005 being hit but since then we have also received reports of websites using Microsoft SQL Server 2008 being injected as well.
Q: Could this mean that there's a vulnerability in Microsoft SQL Server 2003 and 2005?
A: No. Everything points to that this is a vulnerability in a web application. We don't know which one(s) yet but SQL Injection attacks work by issuing SQL commands in unsanitized input to the server. That doesn't mean it's a vulnerability in the SQL Server itself, it means that the web application isn't filtering input from the user correctly."
Alan
Apr 2nd 2011
1 decade ago
Martin
Apr 2nd 2011
1 decade ago
Posted a list of all domains we saw so far here:
http://blog.sucuri.net/2011/04/lizamoon-mass-sql-injection-ur-php-updates.html
thanks,
David Dede
Apr 4th 2011
1 decade ago