Tibet attack Trojan identified

By Shaun Nichols
Apr 12, 2008 6:37 AM
Tags: tibet | attack | trojan | identified

A new SQL-based Trojan has been connected to the www.vnunet.com on pro-Tibet websites as well as the www.vnunet.com of site infections uncovered last month.

A pair of researchers are reporting that the 'Fribet' Trojan has spread among users by embedding itself in pro-Tibet websites by way of an SQL injection and then exploiting a browser vulnerability to remotely install and execute.

McAfee researchers Shinsuke Honjo and Geok Meng Ong reported on a company blog posting that the Trojan not only gives the attacker the ability to remotely control and perform installations on infected PCs, but it also provides the ability to receive SQL instructions.

This, the researchers say, can allow the attacker to use infected machines to host other web exploits.

"This Trojan apparently can be used as an alternate to SQL Injection attacks, but in a more direct way," they wrote.

"Even the administrators of secure websites, protected against common SQL injection attacks, should ensure database backends are equally secure to defend against such a penetration vector."

There are, however, some mitigating factors. At the time of the posting, the server that the infected machines connected to was not active, so computers running the Trojan were not being sent commands.

The researchers also noted that in order to host web exploits on a machine, an attacker would need extensive information on a machine's network configuration and user credentials. Researchers do, however, believe that such information could be obtained through Fribet's info-stealing components.

  • Email a Friend
  • Print Page
Tibet attack Trojan identified
 

Copyright ©v3.co.uk

 


Comments

Be the first to comment on this article.
Thoughts on this article? Add a comment below.
Comment:
Want to participate in the discussion?
Or log in now to comment


Top Stories
A guided tour of Cisco's proof-of-concept centre
A data centre to test your customers' rigs.
 
Interview: Peter Kazacos and the "wild west" of IT
CRN talks to Hostech chairman and industry veteran, Peter Kazacos.
 
On the Move: March
Updated: Appointments and promotions.
 
Shortcutsall you need to know on...
  • How to run your business successfully 
  • NBN 
  • Windows 7 
  • Unified Communications 
  • Smart Power 
Latest Comments
"Informative post. thanks for the info shared here about the Cloud computing conference. Recently ..."
by shruthihr_80 Mar 20, 2010 10:37 PM
 
"Haha...What a sad little man JL must be. Whinges about the NBN now wants in on it, We don't want ..."
by firey1 Mar 20, 2010 4:56 PM
 
"Thanks Glen, I've made those corrections."
by sholtomacpherson Mar 19, 2010 10:33 AM
 
"This result is the law! It even applies to the small telco sellers in the mall of a shopping ..."
by peter Mar 18, 2010 9:10 PM
 
"Additionally, any small business with growth (and competition) on their mind would do well to ..."
by bld Mar 16, 2010 9:54 PM
Polls
Have you experienced a problem when returning faulty goods to online retailers?


   |   View results
Never
  33%
 
Only once
  25%
 
All the time
  42%
TOTAL VOTES: 12

Vote now
CRN Magazine

Issue: 277 | March, 2010

CRN Magazine looks in-depth at the emerging issues and developments for the Channel, and provides insight, analysis and strategic information to help resellers better run their businesses.