Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Deja-Vu - database attack vector development - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Deja-Vu - database attack vector development

Over on the McAfee Avert Labs Blog, analysts Shinsuke Honjo and Geok Meng Ong have posted additional analysis of the Fribet trojan. The trojan "loads the “SQL Native Client” ODBC library, and is designed to receive arbitrary SQL statements from a command and control server. In turn, the ODBC library provides the functionality to Fribet to bind SQL connections and run arbitrary SQL commands from the victim machine(s)". A bit later they note "The attacker still needs to find out the information required to connect the database such as DSN, hostname, database name, User and Password, however, that information can be collected via other monitoring functions".

All your databases accessed by database support are theirs ( ; ^ ( 

 

Patrick

193 Posts

Sign Up for Free or Log In to start participating in the conversation!