Security researchers have unearthed more details about a Trojan that targets backend databases as well as desktop clients.

The Fribet Trojan has been planted on pro-Tibet websites, possibly using a Vector Markup Language flaw (MS07-004) patched by Microsoft early last year. When visitors to the pro-Tibet websites are infected, the Fribet Trojan creates a backdoor on compromised hosts.

In addition, the Trojan loads a "SQL Native Client" ODBC library that's designed to execute arbitrary SQL statements received from a command and control server. The feature provides the ability to run arbitrary SQL commands from compromised machines onto connected database servers. This functionality allows hackers to steal data or modify databases, providing they are able to log onto these databases in the first place.

The attacker still needs to find out the host name, database name, username and password. However, monitoring functions included with Fribet as well as easily-guessable weak and default values might leave the door open for hackers, net security firm McAfee reports.

The Fribet Trojan emerges little more than a month after SQL injection attacks, which inserted iFrame links to sites hosting exploit scripts and malware on legitimate websites.

Unlike those attacks, the Fribet Trojan can be used against the attack sites protected against conventional SQL injection attacks. McAfee researchers Shinsuke Honjo and Geok Meng Ong explain.

"This Trojan apparently can be used as an alternate to SQL Injection attacks, but in a more direct way," they write. "Even the administrators of secure web sites, protected against common SQL injection attacks, should ensure database backends are equally secure to defend against such a penetration vector." ®

Related stories

• Phoenix Mars website invaded by hackers (2 June 2008)
• Mass SQL injection hits English language websites (21 May 2008)
• Botnet sics zombie soldiers on gimpy websites (14 May 2008)
• Department of Homeland Security website hacked! (25 April 2008)
• Web infection attacks more than 100,000 pages (24 April 2008)
• Chinese hackers call off CNN attack (21 April 2008)
• Pro-Tibet rootkit Trojan poses as cartoon (15 April 2008)
• RSA Demo shows how web attack threatens fabric of the universe (9 April 2008)
• Trend Micro gets slashed in attack of the killer iframes (13 March 2008)
• Drive-by download menace spreading fast (23 January 2008)
• Mass web infection leaves researcher scratching her head (11 January 2008)
• Miscreants subvert search results to punt malware (28 November 2007)
• Monster Trojan monsters job seekers' records (21 August 2007)
• Interview MPack developer on automated infection kit (23 July 2007)