In early April, I wrote about the famed “LizaMoon” SQL-injection attacks. I said it then, and I’ll say it again now: SQL-injection (SQLi) attacks are a constant. Some of these attacks are more visible than others. Some adversaries find intelligent ways to hide their tracks so as not to splatter evidence of their misdeeds all over various search engine results and caches.
There have been a number of reports and studies on the SQLi threat and the extent to which various regions/platforms/verticals/etc. are exposed. The basic takeaway runs along these lines:
- On any given day, it is normal to expect to see around 1,600 SQLi attacks against the most attractive servers (Microsoft IIS/ASP.NET and Apache, for example)
- The most prevalent and attractive (to the attackers) servers or platforms could easily expect to log 40 to 80 SQLi attempts per hour
Those are the current stats. Does this mean we should not be worried about the Urchin.js attacks? Goodness, no. But, my answer would be the same for the other 1,599 attacks going on every day.
As I highlighted in my previous LizaMoon blog:
Before any of us blow our IT budgets on database security goodies, we must all take the basic first steps. Simple and core techniques, such as constraining user input, validating user input, limiting types of input, encrypting sensitive data, and designing accounts with the principle of least privilege will go a long, long way.
The same basic principle holds true for this event.
On a side note, a few other handy stats may help put this into perspective.
- According to Netcraft and a few others, there are around 505,000,000 sites on the web
- Apache is the most popular web server platform, running around 327,000,000 sites
- Microsoft (IIS/ASP.NET) is the second-most popular server platform, running around 79,000,000 sites
The SQLi attacks associated with the urchin.js script inclusion are specific to ASP.NET servers. Current stats indicate that the number of injected/affected hosts is just over 1,000,000.
This particular attack really began to take root at the beginning of this month.
Once the news broke, it was quite easy (via simple Google queries) to see evidence of the injections on affected sites.
Searchin' for Urchin
Technical Meat and Potatoes?
The injected script (urchin.js) forces the browser session to direct traffic to a number of malicious domains. At this point we have observed a variety of secondary malware. They range from the most basic generic Trojan families, to DNS changers, and now to rogue video codecs (bogus Adobe Flash Player, for example), which are backdoor Trojans.
The latest variants (example: MD5: fb4c93935346d2d8605598535528506e) are no different. This sample in particular is a rogue Flash Player install.
This Trojan contacts an number of remote hosts that are known to be “sketchy” and have been associated for years with other malware campaigns. (Remote hosts are registered under GigeNET.)
The LizaMoon Relationship
The original attack domains are:
- nbnjki.com
- jjghui.com
Both of these share the same domain registration details as the original LizaMoon attacks.
| Domain name: nbnjki.com
Registrant Contact: JamesNorthone James Northone +1.5168222749 fax: +1.5168222749 128 Lynn Court Plainview NY 11803 US |
Again, both the original attack domains are registered under BIZCN.COM, which has a less than stellar reputation of associations (direct or otherwise) with malicious domains. This reputation can be traced back for several years.
Make Me Feel Safe–Again
I hope this information has put the threats in perspective. Don’t get me wrong; this attack is certainly visible, and deserves the attention of those who are exposed. I would like to stress (as we have done before) that this attack is one of many that occur constantly. Establishing a strong security posture and embracing the most basic and essential steps in web and database security will go a long way. You’ll find yourself much less exposed to Urchin.js as well as to the thousands of other SQLi attacks that are targeting your environments.
As of this writing, here’s your McAfee-specific coverage information:
| McAfee AV/MWG | Associated malware threats are covered under Generic.dx (varies), DNSChanger.cw, and Generic Backdoor!dsm. This coverage also applies to the McAfee Web Gateway. |
| GTI-Enabled Coverage | Coverage for associated domains/IPs is provided in deployments running the GTI component (example: McAfee Firewall Enterprise, McAfee Network Security Platform, McAfee Web Gateway, and more). |
We will continue to update our content/coverage/countermeasures, as the situation requires.