Threat Level: green Handler on Duty: Renato Marinho

SANS ISC: InfoSec Handlers Diary Blog - Deja-Vu - database attack vector development InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Deja-Vu - database attack vector development

Published: 2008-04-13
Last Updated: 2008-04-13 08:05:06 UTC
by Patrick Nolan (Version: 1)
0 comment(s)

Over on the McAfee Avert Labs Blog, analysts Shinsuke Honjo and Geok Meng Ong have posted additional analysis of the Fribet trojan. The trojan "loads the “SQL Native Client” ODBC library, and is designed to receive arbitrary SQL statements from a command and control server. In turn, the ODBC library provides the functionality to Fribet to bind SQL connections and run arbitrary SQL commands from the victim machine(s)". A bit later they note "The attacker still needs to find out the information required to connect the database such as DSN, hostname, database name, User and Password, however, that information can be collected via other monitoring functions".

All your databases accessed by database support are theirs ( ; ^ ( 

 

Keywords:
0 comment(s)
Diary Archives