SQL injection attack (Updated "mass " version) hitting the web

Again a mass SQL injection attack is making its rounds on the web – this one called jjghui referring to the website it redirects traffic to. As Armorize reported, this is yet another play on using SQL injection to inject malicious JavaScript in ASP.NET websites. So far, a Google search shows 180,000 pages have already been infiltrated by this attack. This attack seems to be targeting smaller sites that lack personnel with the skills and security awareness of larger and more well-known sites.

This attack methodology is the same type that has been used many times before on a massive scale. Legitimate websites are serving up malware as quick as McDonald’s serves up piping hot fries.

This attack does several things:

1. A link to malicious JavaScript code is injected into vulnerable ASP.NET sites that serves webpages that have html content stored in SQL Server backend databases

2. The infected pages execute malicious script code from jjghui.com which in turn poisons a user’s machine with malware and recruits it to a botnet.


3. Attackers can load any payload (ie. Trojan, keylogger, command and control server) onto any computers that surf that website:

A command and control server allows an attacker to execute shell commands on the infected computer. Basically executing any command or program, including access to the local network that the computer is part of. This could allow access to file servers, databases, etc. Amongst other things, attackers can steal usernames, password hashes, credit card numbers, delete and modify database information and of course, download any of the information accessed.

While in this case it appears that the SQLi vulnerabilities exploited are only used to inject malicious JavaScript to fool people into buying fake AV software, it also provides attackers with direct access to the database behind the website and all of that data stored there. Since all of these infected websites can easily be identified by doing a simple Google search, to an attacker, Google is becoming the Yellow Pages of vulnerable websites. Once these websites are searchable, not only can the attackers go back and further exploit these vulnerabilities, copycat attackers can also run a SQLi and compromise the database just as easy.

The jjghui mass SQL Injection attack also has many similarities to the LizaMoon attacks from last spring. For starters, by looking on the Whois entry, both LizaMoon.com and jjghui.com are owned by James Northone of Plainview, New York. Who is James Northone? No one knows, but the registration definitely links the two sites.
Here are some more similarities to the LizaMoon attacks:

Infected sites are ASP.NET sites with SQL Server backends.
A script link is injected into columns that build the page html.
The injected link will call yet more Script code from a third party site.
The third party code is obfuscated malicious JavaScript code.
This code redirects yet to another site with a fake Antivirus scam. It is also exploiting known vulnerabilities in JavaScript and Flash.

Technical Details:

The injected script code looks as follows:



At the referenced location, obfuscated JavaScript code is hosted in form of char codes (letters represented as numbers) that get decoded on the fly into working and malicious JavaScript. The obfuscation of the code makes it harder for firewalls and AV software to detect the attack. This code leaves a cookie on the browser and then navigates to a malicious URL at strongdefenseiz.in.

Databases at risk

The reason this attack is so successful is because it automatically finds vulnerable ASP.NET websites with SQL Server backend databases that can be exploited with a simple SQL Injection attack. Some of these sites might have been scoped out in LizaMoon and previous attacks.

Data stored in the database can be compromised not only by the people behind “James Northone” but also by any copycat attackers that run a simple Google query to find the vulnerable websites. Once compromised, the attackers can potentially access any data on the database backing the website, especially if there is no proper separation of duties. For example, on a shopping website, customer data such as email addresses and credit card numbers might be at risk.


How can I ensure that my organization is protected?

There is no easy workaround for the database component of this threat besides fixing the SQLi vulnerabilities on the site and employing the best practices mentioned below. However, employing a database activity monitoring solution will help to address this issue.

This and most other SQL Injection attacks are a case study in poor coding and database configuration practices. When web applications are written correctly and their backend databases are managed against vulnerabilities, SQL injections are proactively prevented. I recommend that organizations take the following steps to protect their site visitors, web applications and database assets:

1. First and foremost, web applications should be reviewed to insure proper input validation on web forms and URL parameters. Database queries to the backend database, especially SELECT, INSERT and UPDATE queries should never be created by simply concatenating a SQL query string with input from web form fields. The input should be sanitized and then parameterized queries should be used to interact with the database.

Note: ASP.NET does this by default. A web developer actually has to bypass some of the features, or disable some default security configurations to make a site vulnerable.
2. Harden your database. Unpatched database vulnerabilities can be exploited by SQL Injection attacks. They can give an attacker elevated privileges and access to sensitive data. For example, unsecure configurations can allow an attacker to execute OS commands through xp_cmdshell, providing full access to database assets. A program of database vulnerability assessment and rights management should be considered a high priority.

3. Enforce proper separation of duties for the web app accounts used to connect to the backend database. Unauthenticated visitors should only have ‘read only’ access to the database backend, and only administrators or content managers should be given insert, or update privileges to the backend tables used to serve up pages. User rights management tools should be used to enforce minimal privileges.


4. Monitor your database traffic. A properly configured database activity monitoring solution will help detect malicious SQL code and the fine grained-audit trail created by a good database activity monitoring solution will also help greatly with forensic analysis needed to reconstruct events in the aftermath of an attack.

Each of these steps incorporated into a defense in depth strategy will protect your data assets and IT infrastructure from SQLi attacks.

9 IT skills for 2012

Techrepublic recently carried out a survey that identified the IT skills that would be in demand in 2012. This time around, IT employers are looking for innovation, as they seek to hire new employees next year.

The Survey took the views of around 300 employers who said the following nine skills would be taken into consideration while hiring.


The Survey took the views of around 300 employers who said the following nine skills would be taken into consideration while hiring.


1.Programming and Application development

61percent want to hire professionals for this skill. Skills required would range from website development to upgrading internal systems and meeting the needs of mobile users. There would be an increased effort to improve access technology for smartphone users. Web development will be another vital area for application development, as leading companies seek to better user experience.

2.Project Management

44 percent plan to hire for this skill. Large projects require project managers, but the recent trend has seen increase in demand for business analysts than project managers. Employers are looking for people who could help deliver projects in time, rather than just monitor. Business analysts help identify user needs and translate them to IT professionals.

3.Help Desk and Technical Supports

Increase in use of technology would mean increased demand for support staffers, internal or external. In many leading companies, technical support forms a starting point for IT professionals to advance their skills, to seek higher roles like that of a system analyst. With innumerable operating systems on the mobile platform, Help Desk has seen a huge rise in demand. 35 percent plan to hire employees for this skill.

4.Networking
35 percent will be hiring for networking skills. The need for networking skills has peaked partly due to virtualization and cloud computing projects. Managers are looking for employees with good experience in the networking field, especially those with VMware and Citrix experience.

5.Business Intelligence
Demand for this skill indicates a shift from focusing on cost savings to investing in technology that provides access to real-time data, enabling better business decisions. 23 percent plan to hire for this skill.

6.Data Center
Data center operations will also be influenced by companies' virtualization and cloud strategies. Employers will be looking for IT professionals with experience in system integration and data center operations. The need for data availability to achieve guaranteed IT service also underscore the requirement of experts in business continuity, disaster recovery, system backup and replication. 18 percent will be hiring for this skill.

7.Web 2.0
18 percent plan to hire for this skill,as technical skills centered on social media remain in demand today.More and more industries are looking for ways to integrate Web 2.0 technologies into their infrastructures. HTML, XML, CSS, Flash and Javascript, .Net will typically be the front end skills required while AJAX and PHP will be for back end

8.Security
Security is a high priority in any company as 17 percent employers plan to hire for this skill. While it is a difficult task to find experience and talent in this field, strong auditing and security are a must for any business organization. Security is always a big concern for many organizations, especially those who consider cloud computing as part of their IT strategies.

9.Telecommunications
9 percent plan to hire for this skill. Companies will be aggressively upgrading their communication systems in 2012, with a strong requirement for voice over IP help. This will make leading companies look for professionals with IP telephone skills. They will also hunt for those experienced in Cisco call center systems.

Galaxy Nexus : Google to Kill Iphone?

Google has revealed the Samsung Galaxy Nexus, the latest "Google phone" that serves as the trend-setter for Android devices also revealed this week. The Galaxy Nexus was unveiled at an event on Wednesday in Hong Kong, after being delayed last week, reportedly as a tribute to the late Steve Jobs.
With the following Stunning features it may kill apple's iphone













Expected Price : 33,800 INR

Happy Diwali to All :)

Orisinal.com - Cute Flash Games For All

Have you ever seen something so cute your legs turned into jelly? Have you ever seen something so cute that you let that cockroach living under your sofa live a couple more weeks? Have you ever seen something so cute that your heart turned into something with the viscosity level of Gerber baby food? Yeah, well I haven’t. But I present you one of the few flash game websites that gets pretty darn close.



Orisinal.com is a site started in 2001 by a quirky guy named Ferry Halim, winning awards and acclaim for its simple yet addictive cute flash games. This website is the essence of simple, cute, fun, and relaxing to take your mind off your worries and put you at ease, at least for a while. So, let’s talk a bit about the games, shall we?

Each of these little squares represents a separate flash game. Each flash game has its own custom composed music, controls, gameplay, and graphics. No two games are alike.

Orisinal likes to use lots of cute and cuddly animals in its games, and the music is some of the best ambient and gentle music I have ever heard. As for the gameplay, most if it requires that you have a mouse and are at least half awake. Take probably its most famous game, for instance: Winter Bells (depicted below). As you move your mouse around the screen, the bunny follows. Once you click, the bunny jumps into the air. The goal is to jump on consecutive bells and go higher and higher, trying to not fall back onto the ground:

There are some other features on the site including linkback, guestbook, “tell a friend”, and an online store where you can purchase mugs, t-shirts, clocks (like the raccoon clock below), and other assortments of goods to make your abode a sunnier, happier place.

You can also arrange flowers in a vase of some sort and send it to someone’s email to brighten their day. Spending a couple of minutes on this site is like enjoying a cup of camomile tea: it’s warm, its relaxing and it generally calms your nerves.

So, when you have some free time (maybe even now), give this great site a shot. It’s main purpose is to have you spend 5 hours at work playing its cute flash games instead of working, then whistle your way back home. Who knows, you might even hug a co-worker or two. Let us know if this brightened up your day.
source: makeuseof.com