Stony Stevenson passed us an ITnews article about the newest scam in online crime. Some 10,000 web pages have been rigged by IT-minded criminals, with the aim of hijacking unsuspecting PCs. The site reports that the users are redirected through a maze of malware, all with the goal of gaining access to personal user information. "The reprogrammed web pages are probably victims of an automated attack that included scanning the internet for unsecured servers and planting a piece of JavaScript code that redirects to a site in China to serve up the malware. The malware cocktail attempts to exploit vulnerabilities in Windows, RealPlayer and other applications to break into the PC. A back door also allows the subsequent installation of additional malicious programs. McAfee Avert Labs first spotted the attack on 12 March. 'Of the 10,000 pages that were compromised a number have already been cleaned up,' the firm stated."
From now on, whenever someone posts something they claim is 'obligatory,' we should point out, "You keep using that word. I do not think it means what you think it means." Dueling memes, what fun!
In addition to sandboxing, browsers should ship with NoScript or equivalent functionality built-in.
Most of the sites that most of the average public uses are heavy on Javascript. A web browser shipped without support for JS by default is not going to win many users.
Far better is a mechanism where content from one server can be authenticated by another server. For example, if http://www.foo.bar/ [foo.bar] served up index.html, and http://authenticator.foo.bar/ [foo.bar] served up an md5 hash based on its copy of index.html, an attacker would have to compromise both servers to fool the checksum.
This works well for static content. For dynamic content each piece would have to be checked independently. There are also other serious issues that would have to be worked out.
If you read TFA not very slashdot I know, but it does say that several of the sites were what would normally be considered trusted and thus could likely end up on such a whitelist so it would hardly protect you against situations like this where trusted websites have been owned by a malware attack themselves.
Interactive code can't be run on the server and still be responsive enough for a good user experience.
Web pages aren't just static content anymore. And other than stuffy people who don't want to let go of the paper document, or paper document + hyperlink models, nobody really thinks they *should* be static content either.
> In addition to sandboxing, browsers should ship with NoScript or equivalent functionality built-in.
You mean like all the browsers of the Mozilla series do? NoScript is just a GUI exposing the Mozilla Security Policies, which have been available via prefs.js since ever. An older one is "Policy Manager" , and the lack of a GUI is even a long term Bugzilla entry.
And yes, the NoScript guys intentionally create the impression that their work is something new.
I suppose I'd give them credit, if nothing else but for the initiative. A commonly-desired behavior isn't much of a "feature" if you have to dig around raw un-user-documented prefs to activate it.
Yeah, because all of the sane webmasters would have quit or killed themselves and the insane ones would be creating pages that no-one would want to visit!
...how do we check our sites to ensure that this code has not been planted. The article gives no clue at all. It doesn't even identify if is platform or technology specific, etc. Just that someone else has set up a huge botnet.
Even sysadmins and webmasters that use best practices and diligently patch, etc. can be gotten because there are always undisclosed holes that are utilized. In fact, were I in that game and I figured out something to defeat security, it would keep it under my ragged black hat and never share that info.
See the posting [slashdot.org] immediately previous to yours.
Yes, TFA is sparse on the details, but if this [govtech.com] is the attack, it is detected by several anti-virus packages.
That rootkit is very stealthy. It might most easily be detected by watching your httpd server logs for random javascript files being served. Some details here [webhostingtalk.com].
Note: I don't know that the above is the exploit described in TFA. I believe this subject was discussed earlier on slashdot. It was in The Reg as well.
the funny thing is this isn't even the worst thing I've seen black hats use. There is this NASTY little exploit in windows that lets a CD-ROM be used to install automatic updates, when automatic updates ARE DISABLED.. think about this a little a cd-rom, CD-r, DVD-r, BD-R so what do you use to back up your data? blank dvds? did you ever notice that a disc left open 'gained' an extra session, somehow some where? BAM huge exploit.. it's the one that got me. i was tied up for weeks trying to figure ways around this nasty virus, and how to not loose all my data... i had no internet and the dang root-kit kept coming back (there were flaws in the root-kit, that caused 'bugs' the big 3 are, 1. a recurrent error in chkdsk where windows keeps complaining about the volume bitmap being corrupted. This is not as reported, a flaw in chkdsk, but something the Root-kit does constantly to 'make all it's infected files completely invisible to rootkit and virus scanners' the only way to scan for those files, is to put the hard drive into a linux machine and 'find' the missing files you can detect the problem in windows though, you navigate to your System Volume Information\_restore{(long number here)}\RP1 the RP1 folder is supposed to contain sequentially numbered temporary files, that are never deleted by normal means... so if you spot a 'numerical gap' in the files listed, you have the root-kit, to prove it pop the drive in a linux machine(or live cd) and the 'missing' numbered files are there, not deleted, not invisible, just 'not in the volume file bitmap' that's the easiest way to detect it, the second and third ways are less scientific, the second way I've detected it is by playing full screen games for many hours straight. if randomly over the course of 2-4 days the desktop shows in mid game for no reason... you have the root kit. sometimes it happens 3-5 times a day, but not always. the third indication doesn't always happen, but sometimes, the root-kit does something wrong, and autoplay gets disabled. usually this is related to frequent dvd movie usage. autoplay will still work on usb drives, but no longer on any optical drives... it's very wierd. in one case, it even screwed up the system so bad that '3 programs' installed on the system would 'set the default screen saver/power management settings back to their original windows defaults every 2 seconds' one of these programs was VLC media player, and frankly trying to watch a movie when the screen goes black every 20 minutes is ANNOYING...
if you have any of the above mentioned symptoms i'd recommend grabbing a live cd linux disc, and mounting the hd and looking in your System volume information folders for signs of files that are only readable under linux.
"Often you hear warnings about not going to untrusted sites," said Craig Schmugar, threat researcher at McAfee Avert Labs... That is good advice, but it is not enough. Even sites you know and trust can become compromised."
In the old days it was easy to avoid malicious sites. Now even your neighbor could be the terrorist... err..I mean.. even sites you know and trust can become compromised.
At least this threat researcher offered a calm analysis with plenty of advice about how to avoid such attacks without recoiling from the web in fear.
Racism can be thinking that your race or culture is better than another's. Believing that, for instance, american democracy is inherently better and more free than other democracies isn't really any different than believing that white people are inherently more civilized than others. I don't understand the distinction you're trying to make.
It reminds me of that Eddie Izzard bit in "Dress To Kill" where he talks about how we as a society abhor serial killers but when we start to get even into the hundreds or thousands or millions we're like, "well done!" that's impressive! In an odd morbid sort of way... I mean, you hear about worms and crap like that or the oddball who hacked A system... but to create a "maze" of over 10k sites?? Well, uh... impressive!
And for anyone who is unfortunate enough not to know Eddie Izzard or who hasn't seen "Dress to Kill", the section is:
And Hitler ended up in a ditch, covered in petrol, on fire, so, that's fun! I think that's funny, 'cause he was a mass-murdering fuckhead. And that was his honeymoon as well! Double trouble!
"Eva, let's marry."
"Where should our honeymoon be?"
"Well, in a ditch, covered in petrol, on fire. I've already arranged it upstairs."
"Oh, how romantic, Adolf."
"Yes, I thought!"
Fun! What a bastard! And he was a vegetarian, and a painter, so he must have been going, "I can't get the fucking trees... Damn! I will kill everyone in the world!"
And he was a mass-murdering fuckhead, as many important historians have said. But there were other mass murderers that got away with it! Stalin killed many millions, died in his bed, well done there; Pol Pot killed 1.7 million Cambodians, died under house arrest at age 72, well done indeed! And the reason we let them get away with it is because they killed their own people, and we're sort of fine with that. "Ah, help yourself," you know? "We've been trying to kill you for ages!" So kill your own people, right on there. Seems to be... Hitler killed people next door... "Oh... stupid man!" After a couple of years, we won't stand for that, will we? Pol Pot killed 1.7 million people. We can't even deal with that! You know, we think if somebody kills someone, that's murder, you go to prison. You kill 10 people, you go to Texas, they hit you with a brick, that's what they do. 20 people, you go to a hospital, they look through a small window at you forever. And over that, we can't deal with it, you know? Someone's killed 100,000 people. We're almost going, "Well done! You killed 100,000 people? You must get up very early in the morning. I can't even get down the gym! Your diary must look odd: "Get up in the morning, death, death, death, death, death, death, death - lunch- death, death, death - afternoon tea - death, death, death - quick shower..."
So I suppose we're glad that Pol Pot's under house arrest... you know, 1.7 million people. At least he - we know where he is - under house arrest! Just don't go in that fucking house, you know? I know a lot of people who'd love to be under house arrest! They bring you your food... "Just stay here? Oh, all right. (singing laconically ) Have you got any videos?" You know, you just sit there all day... And Pol Pot was a history teacher. And Hitler was a vegetarian painter. So... mass-murderers come from the areas you least expect it. I don't know how the flip comes over, but it happens.
First, people figured out that in order to hijack people's PCs for "bot net" purposes, they could try to trick them into installing a program that would slip it in, along with the desired program being loaded. But along came all the "spyware cleaner" packages, that could identify and remove the malware, leaving the originally desired software installed and running.
So the next trick was to try to make removal difficult or impossible by infecting a PC with a "downloader virus". That way, the virus itself would try to avoid detection, but silently download and install spyware from various sites around the world. The user might figure out he/she was infected with the spyware and try to clean it with a remover, but it would keep coming right back, as the original virus kept re-downloading the stuff.
This led to popular anti-virus packages starting to blur the lines between spyware and virii (in cases where the company in question didn't have a specific anti-spyware product ready to sell you). They'd just attempt to clean ALL of the stuff up. Others wanted you to run 2 distinct programs together to protect against both types of threats. In any case, all of this confused a lot of people -- but also made them catch on that a lot of this stuff appeared to be impossible to clean ONLY because of that "downloader trojan horse" trick.
After they started "wising up" and unplugged their Inet connections while doing all the virus and spyware removal... the "evil doers" had to escalate things further.
The current ploy of injecting the stuff from normally benign web sites is pretty much the "next logical step" for them. Doesn't surprise me a bit. I think we'll continue to see more and more of this, too. After all, this attack has several vectors. DNS server entries could be spoofed, redirecting people to fake sites. Web servers with security flaws could be compromised, and modified code loaded directly onto them. Or maybe, legitimate sites will unwittingly host infected ad banners down their pages, paid for by "advertisers" with motives other than really caring if you view the ad's visible content?
It makes you wonder what the next logical step after this one is, doesn't it? Personally, I suspect that we will start seeing DNS cache and Route poisoning attempts become much more commonplace. Particularly after the whole "YouTube gets 'knocked offline' because of an improper route broadcast by a piss-ant totalitarian country" issue we had in recent weeks.
I would bet good money that there were criminals rubbing their hands together with glee over the idea of dumping MILLIONS of users to a malware server s
I discovered my site had a directory and just under 2500 pages added to it. The directory and file dates are January 9th 08 and every one of the html files has the same script code in it. My research turned up indication of two mass site hacks in January.
A google search for threeseas.net/blogger/log/cache/ (cache being the directory that contained the files [past tense]) shows up about 4500 site pointing to one of the files in that directory. Some of the findings are even sourceforge sites and you can tell they have been hacked as well. In other words there are a lot of hacked sites besides mine.
I notified google this morning and my host has already removed the files from my site as the owner and group were set that I couldn't do this myself.
anyways rather that posting the code, a check sum would be better of the code starting with teh word "function" to the end of the code.
Signaturing a dynamic script is not effective. Signaturing the exploiting code itself is also not effective, since these exploits are changing continually to stay ahead of current zero-day threats and available patches.
Sounds like it would be rather difficult to get a checksum for you, sorry.
McAfee Avert Labs described the assault as "one of the largest attacks to date of this kind".
The attack serves as a reminder that even trusted websites can be malicious, McAfee warned.
"Often you hear warnings about not going to untrusted sites," said Craig Schmugar, threat researcher at McAfee Avert Labs."That is good advice, but it is not enough."
McAfee Avert Labs first spotted the attack on 12 March.
I wonder who can sell us some sort of software to guide us out of this maze of evil webpages?
If McAfee (and others) really wanted to solve this "problem", then they would have to do little more than TELL US what the domain name, IP address, etc. of the offending server was!
If we knew that, we could reject any requests from there at the application OR server level, or even both.
And when they move to a new server, same thing. Of course, it would be helpful to have signature(s) of the code as well, but let's STAMP OUT the immediate problem, then worry about potential problems.
I know the "security" companies are commercial interests. But there are times when responsibility toward your community trumps making an enormous profit.
WHAT ip addresses? This article gives NO information about the attack, doesn't mention any of the sites that were compromised, doesn't say what information is being sent or anything.
I've been saying (and doing) this for years. China, South Korea, Malaysia, some parts of Russia... It sucks for them, but until their Governments/ISPs clean up the network, banning entire IP blocks is one of the better defenses against these malware floods. I figured it out while studying IDS logs a while ago, and noticed 98-99% of all exploit scans were coming from those countries. I do feel sorry for the good people who are getting blacklisted on behalf of their shit-flinging neighbours, but part of m
Oblig. (Score:3, Funny)
Re:Oblig. (Score:4, Funny)
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Another oblig (Score:5, Funny)
Re:Another oblig (Score:5, Funny)
You are in a maze of twisty little web pages, all alike.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
It is pitch black. (Score:5, Funny)
Parent
Obligatory criticism of the use of 'obligatory' (Score:5, Funny)
Parent
Re:Dueling memes.. (Score:4, Funny)
Parent
Including Slashdot? (Score:4, Insightful)
Seriously, it's time to seriously sandbox web browsers and have "no extensions" by default with overrides on a per-page, per-session basis allowed.
In addition to sandboxing, browsers should ship with NoScript or equivalent functionality built-in.
Re:Including Slashdot? (Score:5, Insightful)
Most of the sites that most of the average public uses are heavy on Javascript. A web browser shipped without support for JS by default is not going to win many users.
Parent
Re: (Score:3, Interesting)
For example, if http://www.foo.bar/ [foo.bar] served up index.html, and http://authenticator.foo.bar/ [foo.bar] served up an md5 hash based on its copy of index.html, an attacker would have to compromise both servers to fool the checksum.
This works well for static content. For dynamic content each piece would have to be checked independently. There are also other serious issues that would have to be worked out.
Your web browser coul
Re: (Score:2, Informative)
NoScript is a no-go (Score:5, Insightful)
Disabling scripts entirely disables dangerous behavior, sure... But is also disables lots of desirable functionality that most people want.
Parent
Re: (Score:2)
Re:NoScript is a no-go (Score:5, Insightful)
Web pages aren't just static content anymore. And other than stuffy people who don't want to let go of the paper document, or paper document + hyperlink models, nobody really thinks they *should* be static content either.
Parent
Re: (Score:2, Informative)
You mean like all the browsers of the Mozilla series do? NoScript is just a GUI exposing the Mozilla Security Policies, which have been available via prefs.js since ever. An older one is "Policy Manager" , and the lack of a GUI is even a long term Bugzilla entry.
And yes, the NoScript guys intentionally create the impression that their work is something new.
Re: (Score:3, Insightful)
Re: (Score:2)
We should make vbscript the standard... (Score:5, Funny)
Re: (Score:3, Funny)
more informative article here (Score:4, Informative)
The Question Webmasters Have Is... (Score:5, Insightful)
Even sysadmins and webmasters that use best practices and diligently patch, etc. can be gotten because there are always undisclosed holes that are utilized. In fact, were I in that game and I figured out something to defeat security, it would keep it under my ragged black hat and never share that info.
Re:The Question Webmasters Have Is... (Score:4, Interesting)
Yes, TFA is sparse on the details, but if this [govtech.com] is the attack, it is detected by several anti-virus packages.
That rootkit is very stealthy. It might most easily be detected by watching your httpd server logs for random javascript files being served. Some details here [webhostingtalk.com].
Note: I don't know that the above is the exploit described in TFA. I believe this subject was discussed earlier on slashdot. It was in The Reg as well.
Parent
Re:The Question Webmasters Have Is... (Score:4, Interesting)
BAM huge exploit.. it's the one that got me. i was tied up for weeks trying to figure ways around this nasty virus, and how to not loose all my data... i had no internet and the dang root-kit kept coming back (there were flaws in the root-kit, that caused 'bugs' the big 3 are, 1. a recurrent error in chkdsk where windows keeps complaining about the volume bitmap being corrupted. This is not as reported, a flaw in chkdsk, but something the Root-kit does constantly to 'make all it's infected files completely invisible to rootkit and virus scanners' the only way to scan for those files, is to put the hard drive into a linux machine and 'find' the missing files you can detect the problem in windows though, you navigate to your
System Volume Information\_restore{(long number here)}\RP1 the RP1 folder is supposed to contain sequentially numbered temporary files, that are never deleted by normal means... so if you spot a 'numerical gap' in the files listed, you have the root-kit, to prove it pop the drive in a linux machine(or live cd) and the 'missing' numbered files are there, not deleted, not invisible, just 'not in the volume file bitmap' that's the easiest way to detect it, the second and third ways are less scientific, the second way I've detected it is by playing full screen games for many hours straight. if randomly over the course of 2-4 days the desktop shows in mid game for no reason... you have the root kit. sometimes it happens 3-5 times a day, but not always. the third indication doesn't always happen, but sometimes, the root-kit does something wrong, and autoplay gets disabled. usually this is related to frequent dvd movie usage. autoplay will still work on usb drives, but no longer on any optical drives... it's very wierd. in one case, it even screwed up the system so bad that '3 programs' installed on the system would 'set the default screen saver/power management settings back to their original windows defaults every 2 seconds' one of these programs was VLC media player, and frankly trying to watch a movie when the screen goes black every 20 minutes is ANNOYING...
if you have any of the above mentioned symptoms i'd recommend grabbing a live cd linux disc, and mounting the hd and looking in your System volume information folders for signs of files that are only readable under linux.
Parent
Great Threat Research (Score:5, Insightful)
In the old days it was easy to avoid malicious sites. Now even your neighbor could be the terrorist... err..I mean.. even sites you know and trust can become compromised.
At least this threat researcher offered a calm analysis with plenty of advice about how to avoid such attacks without recoiling from the web in fear.
MUST BUY MCAFEE...
Wait, so we know the physical location... (Score:2)
Re: (Score:2)
No. Killing them that way is not slow and painful enough.
Re: (Score:3, Funny)
A number. (Score:2)
Re: (Score:2)
That said, you are otherwise correct.
Re: (Score:2)
Re: (Score:2)
Pages != Sites (Score:3, Interesting)
Impressive! (Score:3, Funny)
Re:Impressive! (Score:5, Funny)
http://www.auntiemomo.com/cakeordeath/d2ktranscription.html#history [auntiemomo.com]
Parent
Isn't this the obvious result .... ? (Score:5, Insightful)
So the next trick was to try to make removal difficult or impossible by infecting a PC with a "downloader virus". That way, the virus itself would try to avoid detection, but silently download and install spyware from various sites around the world. The user might figure out he/she was infected with the spyware and try to clean it with a remover, but it would keep coming right back, as the original virus kept re-downloading the stuff.
This led to popular anti-virus packages starting to blur the lines between spyware and virii (in cases where the company in question didn't have a specific anti-spyware product ready to sell you). They'd just attempt to clean ALL of the stuff up. Others wanted you to run 2 distinct programs together to protect against both types of threats. In any case, all of this confused a lot of people -- but also made them catch on that a lot of this stuff appeared to be impossible to clean ONLY because of that "downloader trojan horse" trick.
After they started "wising up" and unplugged their Inet connections while doing all the virus and spyware removal
The current ploy of injecting the stuff from normally benign web sites is pretty much the "next logical step" for them. Doesn't surprise me a bit. I think we'll continue to see more and more of this, too. After all, this attack has several vectors. DNS server entries could be spoofed, redirecting people to fake sites. Web servers with security flaws could be compromised, and modified code loaded directly onto them. Or maybe, legitimate sites will unwittingly host infected ad banners down their pages, paid for by "advertisers" with motives other than really caring if you view the ad's visible content?
Re: (Score:3, Insightful)
Personally, I suspect that we will start seeing DNS cache and Route poisoning attempts become much more commonplace. Particularly after the whole "YouTube gets 'knocked offline' because of an improper route broadcast by a piss-ant totalitarian country" issue we had in recent weeks.
I would bet good money that there were criminals rubbing their hands together with glee over the idea of dumping MILLIONS of users to a malware server s
can anyone tell me the checksum of the code? (Score:5, Informative)
A google search for threeseas.net/blogger/log/cache/ (cache being the directory that contained the files [past tense]) shows up about 4500 site pointing to one of the files in that directory. Some of the findings are even sourceforge sites and you can tell they have been hacked as well. In other words there are a lot of hacked sites besides mine.
I notified google this morning and my host has already removed the files from my site as the owner and group were set that I couldn't do this myself.
anyways rather that posting the code, a check sum would be better of the code starting with teh word "function" to the end of the code.
Re:can anyone tell me the checksum of the code? (Score:4, Informative)
Sounds like it would be rather difficult to get a checksum for you, sorry.
Parent
Save us (Score:5, Funny)
McAfee Avert Labs described the assault as "one of the largest attacks to date of this kind".
The attack serves as a reminder that even trusted websites can be malicious, McAfee warned.
"Often you hear warnings about not going to untrusted sites," said Craig Schmugar, threat researcher at McAfee Avert Labs."That is good advice, but it is not enough."
McAfee Avert Labs first spotted the attack on 12 March.
I wonder who can sell us some sort of software to guide us out of this maze of evil webpages?
If this is true... (Score:2)
That's right. 911,000!
THANKS A LOT, "SECURITY"! FOR NOTHING! (Score:4, Insightful)
If we knew that, we could reject any requests from there at the application OR server level, or even both.
And when they move to a new server, same thing. Of course, it would be helpful to have signature(s) of the code as well, but let's STAMP OUT the immediate problem, then worry about potential problems.
I know the "security" companies are commercial interests. But there are times when responsibility toward your community trumps making an enormous profit.
It's called a hosts file (Score:2)
Re: (Score:2)
It may as well have been just the headline.
Re:It's called a hosts file (Score:4, Informative)
http://www.avertlabs.com/research/blog/index.php/2008/03/12/another-mass-attack-underway/ [avertlabs.com]
Parent
Re: (Score:3, Insightful)
Re:What's vulnerable? (Score:4, Funny)
Yes.
Parent