Slashdot Log In
Mass Website Hack Compromises 200,000 Sites
Posted by
Zonk
on Mon Mar 17, 2008 10:23 PM
from the that-is-a-lot-of-angry-pr0n-bots dept.
from the that-is-a-lot-of-angry-pr0n-bots dept.
Stony Stevenson writes "Hot on the heels of a recent hack in which 10,000 sites were compromised, researchers have disclosed a new large-scale attack. Researchers at McAfee estimated that the attack has been active for roughly one week, and in that time frame has managed to place itself on roughly 200,000 web pages. Most of the infected pages are running the phpBB forum software, said McAfee. The compromised pages are embedded with a Javascript file that links to the site hosting the attack."
Related Stories
[+]
10,000-website Strong Malware Maze Created by Criminals 118 comments
Stony Stevenson passed us an ITnews article about the newest scam in online crime. Some 10,000 web pages have been rigged by IT-minded criminals, with the aim of hijacking unsuspecting PCs. The site reports that the users are redirected through a maze of malware, all with the goal of gaining access to personal user information. "The reprogrammed web pages are probably victims of an automated attack that included scanning the internet for unsecured servers and planting a piece of JavaScript code that redirects to a site in China to serve up the malware. The malware cocktail attempts to exploit vulnerabilities in Windows, RealPlayer and other applications to break into the PC. A back door also allows the subsequent installation of additional malicious programs. McAfee Avert Labs first spotted the attack on 12 March. 'Of the 10,000 pages that were compromised a number have already been cleaned up,' the firm stated."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Please be more forthcoming (Score:5, Insightful)
Here too, we have a threat which is already running wild. Thousands of websites are being attacked. Unfortunately, this article, like many which abound in the security theatre online media, is long on consequences and short on details. Someone knows how the attack spreads, but they aren't sharing the means of stopping the attack.
This article and its lack of content does as much to spread fear and chaos among computer users as the actual attack. These are technical problems which can be fixed. By not being clear about the threat, the article turns hackers into bogeymen that can't be stopped. Give some better info, tell us how to close the hole, and let us get back to work.
Re:Please be more forthcoming (Score:5, Insightful)
Oh they'll have an answer for that -- just buy McAfee's "protection".
Remember- your Mac is spreading viruses, even if it's not infected.... Be ashamed!
Parent
Re: (Score:2, Informative)
For a properly maintained phpBB site, this isn't that big of a deal. As a maintainer for a site which uses phpBB, I can tell you that I have seen this attempted for months. I believe phpBB is mentioned directly because it seems there are programs which allow individuals to create forum accounts and post messages using an automated script. The scripts post messages to visit a (usually) pornographic site. Once you connect you are presented with a page with a display which mimics YouTube.com, however a pop
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Unfortunately, this article, like many which abound in the security theatre online media, is long on consequences and short on details. Someone knows how the attack spreads, but they aren't sharing the means of stopping the attack.
I always thought the news were to report news, and that the knowledge itself was stored somewhere else.
I'd like to report another case then. Last week I read news about a new book, and the book was not printed in the papers. Actually, the news didn't even tell me where to buy the book.
Re: (Score:3, Funny)
Ewww. Too much information.
Re: (Score:2)
Re:Internet-connection license? (Score:5, Informative)
Parent
Re: (Score:2)
Do you want more posts that start like this, "This reminds me of George Bush's environmental policy..."
Moderation is supposed to stop that sort of thing. Instead he's +5.
Good news for us, I guess... (Score:4, Insightful)
Am I completely off-base here?
Re: (Score:3, Insightful)
Re:Good news for us, I guess... (Score:4, Insightful)
I do not believe anyone really knows what market share the various forums have, but it is generally believed that the most popular are Simple Machines, phpBB, vBulletin, and Invision Power Board (in no particular order).
I cannot believe that phpBB has so many successful attacks simply because it has a large installation base, otherwise these other forum softwares would also be suffering the same fate.
Parent
Re:Good news for us, I guess... (Score:5, Insightful)
Parent
Re:Good news for us, I guess... (Score:5, Funny)
Perhaps they should rename it to PenguinBB so that hackers ignore it. Better yet, EmacsBB (or does it already have one builtin?)
Parent
Re:Good news for us, I guess... (Score:5, Insightful)
Except that popularity != exploitability. Many people think that software is like a safe - if you grind at it long enough, eventually it'll open. Software isn't like that. You can grind at software forever and it won't change anything unless you actually find a vulnerability - a case not handled by the software.
For example, MySQL is much more popular online than Microsoft SQL. Yet MS-SQL gave rise to the slammer worm [google.com] while the vastly-more-commonly-installed MySQL has not ever been infected by anything anywhere near the same magnitude. (Yes, there have been a few. They didn't get very far)
The formula is NOT:
Popularity = Exploited.
It's more like
Popularity * Bad Design = Exploited.
And even bad software can eventually be cleaned up. Sendmail used to be a security nightmare. But despite its position as the #1 mail server software on the Internet, it's been quite a few years since any serious vulns were exploited.
Parent
why this happens (Score:5, Interesting)
Re: (Score:2)
Then again, I just had to fix my vista machine from the endless reboot of death. ^ ^
Re: (Score:2)
Re: (Score:2)
Re:why this happens (Score:4, Insightful)
Parent
Well, (Score:5, Funny)
Re: (Score:2, Funny)
Re: (Score:3, Funny)
Must be a special offer from Pen Island.
Why is it always porn? (Score:3, Insightful)
Re:Why is it always porn? (Score:5, Funny)
Parent
Language is a Virus (Score:5, Insightful)
Pages, not sites (Score:5, Informative)
According to this video [avertlabs.com], the pages are being inserted via SQL injection attacks. The 200k pages is based on a google search (he does not reveal what criteria he is searching for) which came back with 150k hits. So it is not clear how many actual sites are compromised. One could assume that once a phpBB site is compromised, every page of every thread, which is analogous to individual web pages, would redirect to the worm download site. A popular forum could easily have several thousand thread-pages. In fact, every single page would probably be redirecting, which would include each user's summary page (which would be in the thousands for even a small site). So a small number of cites could be accounting for all the 200k pages.
Also, in the video it is clear from the url that it is a phpBB2 site that is compromised. phpBB is currently at a major version of 3.
The attack modifies the forum title (Score:5, Interesting)
When this news broke last night (my local time), my heart skipped a beat because one of my phpBB instances isn't totally up to date, so I did a quick bit of research to see if I could fill in the massive blanks left by this report. Yes, it does look like an SQL injection attack: the attack appends a SCRIPT tag to the forum's main title, which is inserted into various locations on every page from a database field. Due to one thing and another this results in some hideously malformed HTML, but it has the desired effect (of executing the Javascript) in the major browsers. I suspect that the search in question is a Google "intitle:" search which keys off the domain name of the site carrying the exploit code, since this becomes a visible part of the title.
I have no idea exactly how the SQL injection is being effected, but my phpBB forum was not impacted. This may be because my version is not too old, because I lack a vulnerable add-on module, or because my custom anti-bot mechanisms deflected the attack. I couldn't see anything in the past few days of log activity which contained key strings used in the exploit, but I didn't search very hard once I determined that my instance was unaffected.
Parent
I'm running phpBB (Score:5, Interesting)
But I've made some modifications to my install. I replaced the registration and profile pages with a web form that posts to an Email parser. There was a lot of activity the last few days, spam registrations out the yang.
It's funny because to them it looks like the registration page and they keep running scripts against it. I block the IP ranges of the spam registrations at the boundary but they just keep block hopping.
They'll still get a script reg through sometimes, so there's something I'm missing. I could just install the security updates but it's so much more fun to try and tweak it myself.
200,000 Sites Hacked (Score:4, Funny)
Re: (Score:3, Informative)
Re: (Score:2)
Upgrade to phpBB3 (Score:2)
ppl r stoop1d. (Score:2, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
No offense, but this isn't 1337. This is a script kiddie attack.
Now, if someone with real "1337" skills did an attack, we would only find out years after the fact, if ever, and they would have gotten away with a fair sum of cash too.
Making Open Source a harder sell (Score:4, Insightful)
Yeah yeah, I know I'll be marked as troll/flamebait or whatever... but I don't see any upmodded discussion of this, it's a serious issue, if only for the perception it fosters in the industry.
The twist (Score:5, Funny)
For a second, you think that humanity may not be the mass of morons you thought. That patching the bug will let you access the real, intelligent, acute comments of human forums.
Then, as the patch starts to work, you see those comments; the beauty of human forums brings a tear to your eye. As you start posting, you feel unable to write, your keyboard doesn't seem to work.
You then understand you were just another spam generator, and the patch is killing you.
Fade to black.
yeah, I find stuff like this in my logs (Score:3, Informative)
Re: (Score:2, Interesting)
Re: (Score:2)
Yeah, I installed it way back in the days and forgot it was on my website. I have now gotten several emails from my domain host stating attacks on it using an exploit in phpBB.
Which is why you're supposed to upgrade. The article is incredibly short and doesn't specify, but I'd be willing to bet the exploit was one that has already been patched/revealed.
At least with this attack the computer savvy not running NoScript or the like will be able to avoid getting hit with the payload. And now, time to check to make sure my ASP pages haven't been attacked...
Re: (Score:3, Insightful)
Re: (Score:2, Interesting)
Re:'social engineering' (Score:5, Funny)
Parent
Re: (Score:3, Insightful)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Re:But most people don't know better... (Score:4, Informative)
First, I'm not sure if your talking ASP or ASP.Net, but either way the vast majority of your comment can be shortened to:
There are lots of PHP packages out there. People think they are safe because they are not MS. PHP packages should be re-written in ASP. PHP breaks due to updates but ASP updates better, therefore ASP is a better choice. PHP isn't inherently insecure, it's the packages.
Your entire statement boils down to this logic:
1) There are a lot of insecure Packages in PHP
3) It's not an insecurity in PHP, it's an insecurity in the packages
2) ASP updates better than PHP
Your comparing apples (ASP) to oranges (PHP Packages). I have no experience how well or poorly the security of packages in PHP perform against the security of packages in ASP.Net, we would have to pick a large pool of them to find out. And just because Windows Updates makes updates available for ASP.Net does not mean that people actually are that willing to reboot their web farms for every update that appears. Your saying the problem is bad coding and that ASP solves it, I would beg to differ.
And here is my anecdotal comment:
I have answered thousands of ASP questions (ASP used to be my primary web 'language') as well as written/re-written many sites and over time I have seen a lot of site examples and snippets that would leave a page wide open or in a position to break on regular occasions (or just plain didn't work). On the other hand I have worked with several PHP packages that were solidly put together and worked against a range of PHP versions. PHP must be better because I haven't personally seen anywhere near as many errors in coding as I have in ASP. None of the first several thousand ASP posts would work at all against the next version of the language (ASP 3 => ASP.Net) and needed to be rewritten from scratch, but most or all of the packages I used with PHP 4 worked just fine with PHP 5.
Parent