A
Firefox add-on has turned 12,500 users of the browser into a botnet
which scours every page visited by infected users for vulnerabilities.
The ‘Advanced Power’ add-on ensnared 12,500 PCs – and found 1,800
vulnerable websites for its unknown creators, according to security
expert Brian Krebs.
SC Magazine says that the add-on also has other capabilities, including password hijacking, but these have not been used.
Based on Google Translate language recognition, Krebs initially
reported that text strings in the malware suggested it might be Czech in
origin. Human inspection by a native Czech speaker in ESET’s labs
revealed that technology was not perfect in this case – and the texts
look more like some dialect of Russian.“The malicious add-on then tests nearly every page the infected user visits for the presence of several different SQL injection vulnerabilities,” according to Krebs.
SQL injection attacks are one of the most common methods used to attack websites, but attackers require vulnerabilities to use them.
“Attackers can use this access to booby-trap sites with drive-by malware attacks, or force sites to cough up information stored in their databases,” Krebs said.
Information Week reports that the malware has been in circulation since May 31 this year at least, and quotes “Kafeine” at the Malware Don’t Need Coffee blog, who said that the malware was distributed at least in part by the Blackhole exploit kit.
Krebs’ report notes that the attack represents a way for
hackers to ‘test’ a much larger sample of websites for vulnerabilities
rather than simply targeting sites at random – by piggybacking on
legitimate site visits, it removes the “blind guesswork” hackers often
have to perform to find vulnerable sites.
Mozilla has now blocked the add-on,
saying, “It is a malicious extension that is distributed under the same
name to trick users into installing it, and turns users into a botnet
that conducts SQL injection attacks on visited websites.”
No comments:
Post a Comment