'LizaMoon' Mass SQL Injection Attack Escalates Out of Control

[err0r]

Millions of unique URLs have been infected with a rampant SQL injection attack Websense has dubbed “LizaMoon.” The SQL injection attack redirects users to a fake AV site.

 

A mass SQL injection attack that initially compromised 28,000 Websites has spiraled out of control. At the last count, more than a million sites have been compromised, with no end in sight.

 

Security firm Websense has been tracking the “LizaMoon” attack since it started March 29. The company’s malware researchers dubbed the attack LizaMoon after the first domain that victims were redirected to. At the redirected site, users saw a warning dialog that they had been infected with malware and a link to download a fake antivirus.

 

The users are shown a number of threats supposedly on their computer, but the fake AV, Windows Stability Center, won’t remove them until the user pays up, in a “very traditional rogue AV scam,” wrote Patrik Runald, the Websense researcher who has been following the attack over the past few days.

 

The list of redirect URLs has ballooned in the days since, as Websense updated its list March 31 with 20 additional sites, making this one of the biggest mass-injection attacks ever.

 

More than 500,000 URLs have been injected with LizaMoon, according to Runald. If all the domains used in the attack are considered, eWEEK found about 2.9 million results on Google Search that have been compromised.

 

“Google Search results aren't always great indicators of how prevalent or widespread an attack is as it counts each unique URL, not domain or site,” Runald said. It is safe to consider hundreds of thousands of domains have been hit, he said.

 

Websense researchers are still trying to figure out how the SQL injection attack is happening. Somehow, legitimate Websites have been compromised in a way that one line of code has been embedded on the site. That code is a simple redirect, and executes when the user loads the page. The bulk of the action happens on the redirected page, where a script containing Javascript code kicks off the fake AV scam.

 

Commenters asked Websense why researchers were so convinced it was a SQL injection on multiple Websites and not a mass cross-site-scripting attack. The researchers said they’d been contacted by people who have seen the code in their Microsoft SQL Server 2003 and 2005 databases. The vulnerabilities weren’t within the database software, but “most likely in the Web systems used by these sites, such as outdated CMS and blog systems,” Runald said.

 

Considering the large number of sites infected, users all around the world are affected, with victims in the United Kingdom, Kuwait, India, Australia, Turkey, Brazil, Israel, Mexico, Taiwan and Chile, among others, according to figures from Websense Threatseeker Network. The bulk of the victims, at 47 percent, appear to be from the United States.

 

The domains used in this attack, including the redirect URLs and the server where the malware is hosted, are all associated with one of four IP addresses, according to Dancho Danchev, an independent security expert. While the 20 or so domains being used as the redirect URL rotate between two IP addresses, Danchev has identified more than 120 India-based or Cocos Island-based domains all pointing to one malware host server, and 50 India-based domains going to another.

 

The domains have all been registered using automatically registered accounts at Gmail, Danchev said. The first domain on the list was registered as far back as October 2010, and new domains have been added since LizaMoon exploded, according to Runald.

 

First, the good news: Users are hit with the Windows Stability Center scam only once, so visiting the site repeatedly doesn’t repeat the attack.

 

The bad news: Not many antivirus programs seem to be able to detect the Windows Stability Center. VirusTotal is a service that checks malware samples against 43 major antivirus products to see which products can detect it. As of April 1, only 17 out of the 43 tested block Windows Stability Scanner. At least, security companies are moving on this threat: It was only 13 out of 43 March 31.