Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
LizaMoon Mass SQL-Injection Attack Infected at least 500k Websites

Websense has been tracking a mass SQL-Injection attack for the past few days that started with only a few ten thousand websites and has exploded to potentially over 1 million websites.  There doesn't seem to be anything particularly new about the infection mechanism (aside of the scope of its success) and the injection itself only inserts a random snippet of HTML to redirect victims to a rogue AV site that tells the user they are infected.

One of the domains implicated in this attack was registered in October and showed up on the radar in December, so it appears the preparation of this attack has taken some time and it's been perculating for awhile.  The bulk of the infections, however, have only just occurred in the last few days.  Infected sites tend to use the same URL structure including a file "ur.php".  It appears this is only affecting sites using Microsoft SQL Server 2003/2005.

Defense against your sites getting infected is the standard things we ought to be doing anyway in regards to SQL injection (i.e.use prepared statements, filter input for control characters, whitelist if possible, blacklist if not).  Webserver administrators should also be checking for sudden appearance of files in their httpdocs directory.  More on this as it develops.

--
John Bambenek
bambenek at gmail /dot/ com
Bambenek Consulting

John

248 Posts
ISC Handler
While input filtering is definitely recommended, it should be mentioned that it is only a partial solution. Parameterized SQL is a great way to mitigate the risk of SQL injection. Also, HTML encoding external data before rendering it in the browser will prevent injected JavaScript from executing. So, the best defense would:

1. Validate input with a whitelist
2. Use only parameterized SQL queries
3. HTML encode data sent to the browser

While it is a good practice in general, I don't think checking httpdocs for unusual files would help here since the injected attack code is coming from the database.
John
1 Posts Posts
What is SQL Server 2003? Something from the Eighth Dimension? I'm thinking this was supposed to be SQL 2000 and reports on Lizamoon keep repeating this non-existent version.
Alan

57 Posts Posts
Based on the suggested actions, the author of this post does not seem to understand how SQL injections work nor does he know what the major versions of Microsoft SQL server are. Even though he links to a page which display the correct version numbers...
Adam

3 Posts Posts
Actually the Websense post does list SQL Server 2003 and does so more prominently than the listing of SQL 2000. The following text is from the Websense page and the Questions are in bold text on the page, whereas Answers are not. This makes the error in the question more prominent and likely to propagation in other posts such as the one above. But still, it does speak to editorial review being lacking on a number of websites...

"Q: How do you know it's using SQL Injection?
A: We have been contacted by people who have seen the code in their Microsoft SQL databases. Initially we only received reports of users running Microsoft SQL Server 2000 and 2005 being hit but since then we have also received reports of websites using Microsoft SQL Server 2008 being injected as well.



Q: Could this mean that there's a vulnerability in Microsoft SQL Server 2003 and 2005?
A: No. Everything points to that this is a vulnerability in a web application. We don't know which one(s) yet but SQL Injection attacks work by issuing SQL commands in unsanitized input to the server. That doesn't mean it's a vulnerability in the SQL Server itself, it means that the web application isn't filtering input from the user correctly."
Alan

57 Posts Posts
I have a write-up on how to check to see if anyone in your org has been redirected to the malicious site on my blog at http://ossectools.blogspot.com. It's got an example request with payload if you're interested in what the traffic looks like.
Alan
13 Posts Posts
The attack is actually bigger than that. Just search on Google for alisa-carter.com/ur.php or milapop.com/ur.php or google-stats50.info/ur.php and you will find thousands more hacked sites...

Posted a list of all domains we saw so far here:
http://blog.sucuri.net/2011/04/lizamoon-mass-sql-injection-ur-php-updates.html

thanks,
Alan
2 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!