Hacking victim Bit9 blames SQL injection flaw

The company's breach came after it failed to install its own security software

Bit9 said a common Web application vulnerability was responsible for allowing hackers to ironically use the security vendor's systems as a launch pad for attacks on other organizations.

Based in Waltham, Massachusetts, the company sells a security platform that is designed in part to stop hackers from installing their own malicious software. In an embarrassing admission, Bit9 said earlier this month that it neglected to install its own software on a part of its network, which lead to the compromise.

In a more detailed explanation on its blog on Monday, Bit9 said attackers gained access by exploiting a SQL injection flaw in one of its Internet-facing Web servers. A SQL injection flaw can allow a hacker to enter commands into a web-based form and get the backend database to respond.

The compromise happened around July 2012, wrote Bit9's CTO Harry Sverdlove. Once inside Bit9, the hackers accessed a virtual machine used to digitally sign code for Bit9, a security measure that verifies the company's code is legitimate.

The compromised server was shut down for about six months, but was brought back online in January. Bit9 then discovered the problem. "We took immediate containment and remediation steps, revoked the certificate in question and reached out to our entire customer base," Sverdlove wrote.

The hackers used Bit9's certificate to sign 32 of their own malicious files and scripts. Sverdlove described some of the malware as backdoors with the names "HiKit" and "HomeUNIX."

With Bit9's certificate, the malware would look legitimate to other security software. As its investigation unfolded, Bit9 found that the hackers planted the malware on other websites, constructing what is known as a drive-by-download attack.

That attack would exploit users running outdated versions of Oracle's Java software, which had been found to contain numerous vulnerabilities in recent months.

"We believe the attackers inserted a malicious Java applet onto those sites that used a vulnerability in Java to deliver additional malicious files, including files signed by the compromised certificate," Sverdlove wrote.

All told, three Bit9 customers were attacked, but Sverdlove did not reveal their names. More than 1,000 companies use Bit9's software, including Fortune 500 companies in banking, energy, aerospace and defense and U.S. federal government agencies.

Sverdlove wrote that the attacks appeared to be designed to "infiltrate select US organizations in a very narrow market space." Utilities, banks and government entities were not affected, he wrote.

Once the malware was installed, it communicated with servers on IP ranges belonging to network providers including New Century InfoComm Tech Co., Ltd. of Taiwan, the Asia Pacific Network Information Centre in South Brisbane, Australia, and Sparkstation in Singapore.

Bit9 said its product code was not affected, but it is reviewing its entire code base. The company also is undergoing a security audit and "addressed the errors that led to the compromise," Sverdlove wrote.

"While we believe Bit9 is the most effective protection you can have on your endpoints, I've always said there is no silver bullet to security," he wrote. "This incident has only fortified what we already knew...the enemy is persistent, sophisticated and motivated.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusionBit9securityExploits / vulnerabilitiesmalware

More about Oracle

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts