I called this one the day after the first wave of mass SQL Injection attacks came out. I told Jeremiah that we would see botnets doing this attack shortly as it was much more efficient. A few weeks later and boom, botnets performing mass SQL Injection.
The interesting thing about these attacks so far is what they are actually doing. They are not attempting to steal data out of these databases directly. They are populating the pages with links that attempt to do drive-by malware installs by exploiting browser vulnerabilities.
Our good friends XSS and CSRF are next.
So here is the attack:
- Find a few permanent XSS vulnerabilities in some high traffic sites
- Find some CSRF vulns in popular blog and forum software
- Use the XSS to inject CSRF payloads into the high traffic sites
- The CSRF payloads create new posts on blogs and forums containing drive-by download links
This is a much more scalable and persistent attack than mass SQL Injection. The XSS lives in the page until someone fixes it. Every visitor to that page becomes a vector. The botnet just needs to find the initial XSS vulnerabilities – after that the attack is self-propagating.
We are not ready for this.