Security Researcher: Web Attacks Across Globe Appear Linked
Three significant waves of SQL injection attacks appear to be under the control of the same source, according to one security researcher.
Thu, August 27, 2009
Network World — Three significant waves of SQL injection attacks appear to be under the control of the same source, according to one security researcher.
America's 10 most wanted botnets
Roughly 80,000 Web sites in China, 67,000 in the U.S. and 40,000 in India remain compromised and under botnet control as a result of separate and ongoing SQL injection attacks. The highest infection point during the last three months reached into the millions at one point in China.
The SQL injection attacks have inserted malicious iFrames into legitimate Web sites in order to force visitors off them and onto dangerous malware-laden sites. Mary Landesman, senior security researcher at ScanSafe, says she believes these three waves of SQL injection attacks are likely the handiwork of the same attacker because of the similarity of the domain-name registration information and style of attack.
"It's the thread of the domain names being used," Landesman says. Seven of these "mal-domains" -- a term coined by Landesman to describe domain names used solely to build Internet infrastructure to spread malware or otherwise cause harm -- were registered under the same name and address (which are clearly bogus, being not more than gibberish).
These domain names are now apparently being farmed out across the world as part of the globally distinct attacks in China, U.S. and India.
In this case, the identified domain names were registered using bogus information provided to registrar Go Daddy, which Landesman says is "highly unusual," since Go Daddy has a generally good reputation and attackers typically prefer "domain name providers that turn a blind eye."
Go Daddy was not immediately available to comment.
But the larger problem isn't specific to any one domain-name registrar, it's the way the domain-name registration system has evolved that invites such rampant abuse. "We have a system that allows people to provide completely bogus details about who they are," Landesman says.
The openness of the domain-name registration system and lack of effective oversight has allowed criminals to exploit it to carry out Internet-based crime, she says. "It's not intentionally designed for this kind of abuse, but it works in favor of the criminals."
The system is "broken, and fixing it is the key to cutting down on these attacks," she says.
