10,000-website Strong Malware Maze Created by Criminals 118
Stony Stevenson passed us an ITnews article about the newest scam in online crime. Some 10,000 web pages have been rigged by IT-minded criminals, with the aim of hijacking unsuspecting PCs. The site reports that the users are redirected through a maze of malware, all with the goal of gaining access to personal user information. "The reprogrammed web pages are probably victims of an automated attack that included scanning the internet for unsecured servers and planting a piece of JavaScript code that redirects to a site in China to serve up the malware. The malware cocktail attempts to exploit vulnerabilities in Windows, RealPlayer and other applications to break into the PC. A back door also allows the subsequent installation of additional malicious programs. McAfee Avert Labs first spotted the attack on 12 March. 'Of the 10,000 pages that were compromised a number have already been cleaned up,' the firm stated."
Oblig. (Score:3, Funny)
Re:Oblig. (Score:4, Funny)
Re: (Score:1)
Re: (Score:3, Funny)
Re: (Score:1)
Re: (Score:3, Funny)
Re: (Score:1, Informative)
From: http://www.encyclopediadramatica.com/9000 [encycloped...matica.com]
Re: (Score:2, Funny)
IT'S OVER NINE THOUSAND! is a meme started from the annie may Dragon Ball Z, where characters would use scouters to detect power levels. It was cuntpasted many a time for the win. No topic goes without it. It's worth noting that in the original man gay, Vegeta noted Goku's power level as being "over 8000", "9000" is a product of Funimation Faggotry.
From: http://www.encyclopediadramatica.com/9000 [encycloped...matica.com]
Cuntpasted? Is that what the kids are doing now-a-days?
Another oblig (Score:5, Funny)
Re:Another oblig (Score:5, Funny)
You are in a maze of twisty little web pages, all alike.
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:1)
Re: (Score:2)
It is pitch black. (Score:5, Funny)
Re: (Score:1)
Re: (Score:1)
Obligatory criticism of the use of 'obligatory' (Score:5, Funny)
Re:Dueling memes.. (Score:4, Funny)
Including Slashdot? (Score:4, Insightful)
Seriously, it's time to seriously sandbox web browsers and have "no extensions" by default with overrides on a per-page, per-session basis allowed.
In addition to sandboxing, browsers should ship with NoScript or equivalent functionality built-in.
Comment removed (Score:5, Insightful)
Re: (Score:1, Interesting)
Re: (Score:3, Interesting)
For example, if http://www.foo.bar/ [foo.bar] served up index.html, and http://authenticator.foo.bar/ [foo.bar] served up an md5 hash based on its copy of index.html, an attacker would have to compromise both servers to fool the checksum.
This works well for static content. For dynamic content each piece would have to be checked independently. There are also other serious issues that would have to be worked out.
Your web browser coul
Re: (Score:2)
Re: (Score:2, Informative)
NoScript is a no-go (Score:5, Insightful)
Disabling scripts entirely disables dangerous behavior, sure... But is also disables lots of desirable functionality that most people want.
Re: (Score:2)
Re:NoScript is a no-go (Score:5, Insightful)
Web pages aren't just static content anymore. And other than stuffy people who don't want to let go of the paper document, or paper document + hyperlink models, nobody really thinks they *should* be static content either.
Re: (Score:1)
Re: (Score:1)
For me, when a company puts up a page that is utterly useless unless you run flash, or javascript, that's a company I turn away from.
Maybe I'm just one of those "stuffy people" you mention. But even if I am, it doesn't mean I don't have legitimate grievances.
Re: (Score:2)
I think the bandwidth issue was pretty core to my argument. Dynamic content can, and should, use less bandwidth than static content to obtain the same level of interactivity.
I'm also not ignoring disability. I just don't think we should say "the web is text" and be stuck with that model forever in order to cater to a lowest common denominator. The fact of the matter is that the web has grown into an application p
Re: (Score:2)
This precaution is currently not enforced, and hence current attacks don't consider it, but if it were enforced, then I have a feeling hackers would just find another way, just as they have done to create the current exploitations.
It is disturbing that plugins such as real player and acrobat can be exploited, since often times an old plugin that is no longer in use will never get
Re: (Score:2)
Re: (Score:2, Informative)
You mean like all the browsers of the Mozilla series do? NoScript is just a GUI exposing the Mozilla Security Policies, which have been available via prefs.js since ever. An older one is "Policy Manager" , and the lack of a GUI is even a long term Bugzilla entry.
And yes, the NoScript guys intentionally create the impression that their work is something new.
Mod parent informative (Score:1)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:1)
http://extremesecurity.blogspot.com/ [blogspot.com]
We should make vbscript the standard... (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:1)
more informative article here (Score:4, Informative)
The Question Webmasters Have Is... (Score:5, Insightful)
Even sysadmins and webmasters that use best practices and diligently patch, etc. can be gotten because there are always undisclosed holes that are utilized. In fact, were I in that game and I figured out something to defeat security, it would keep it under my ragged black hat and never share that info.
Re:The Question Webmasters Have Is... (Score:4, Interesting)
Yes, TFA is sparse on the details, but if this [govtech.com] is the attack, it is detected by several anti-virus packages.
That rootkit is very stealthy. It might most easily be detected by watching your httpd server logs for random javascript files being served. Some details here [webhostingtalk.com].
Note: I don't know that the above is the exploit described in TFA. I believe this subject was discussed earlier on slashdot. It was in The Reg as well.
Re:The Question Webmasters Have Is... (Score:4, Interesting)
BAM huge exploit.. it's the one that got me. i was tied up for weeks trying to figure ways around this nasty virus, and how to not loose all my data... i had no internet and the dang root-kit kept coming back (there were flaws in the root-kit, that caused 'bugs' the big 3 are, 1. a recurrent error in chkdsk where windows keeps complaining about the volume bitmap being corrupted. This is not as reported, a flaw in chkdsk, but something the Root-kit does constantly to 'make all it's infected files completely invisible to rootkit and virus scanners' the only way to scan for those files, is to put the hard drive into a linux machine and 'find' the missing files you can detect the problem in windows though, you navigate to your
System Volume Information\_restore{(long number here)}\RP1 the RP1 folder is supposed to contain sequentially numbered temporary files, that are never deleted by normal means... so if you spot a 'numerical gap' in the files listed, you have the root-kit, to prove it pop the drive in a linux machine(or live cd) and the 'missing' numbered files are there, not deleted, not invisible, just 'not in the volume file bitmap' that's the easiest way to detect it, the second and third ways are less scientific, the second way I've detected it is by playing full screen games for many hours straight. if randomly over the course of 2-4 days the desktop shows in mid game for no reason... you have the root kit. sometimes it happens 3-5 times a day, but not always. the third indication doesn't always happen, but sometimes, the root-kit does something wrong, and autoplay gets disabled. usually this is related to frequent dvd movie usage. autoplay will still work on usb drives, but no longer on any optical drives... it's very wierd. in one case, it even screwed up the system so bad that '3 programs' installed on the system would 'set the default screen saver/power management settings back to their original windows defaults every 2 seconds' one of these programs was VLC media player, and frankly trying to watch a movie when the screen goes black every 20 minutes is ANNOYING...
if you have any of the above mentioned symptoms i'd recommend grabbing a live cd linux disc, and mounting the hd and looking in your System volume information folders for signs of files that are only readable under linux.
Re: (Score:1, Funny)
Fixed that for you.
Re: (Score:1)
Re: (Score:2, Informative)
http://www.theregister.co.uk/2008/03/13/trend_micro_website_infected/ [theregister.co.uk]
The list is over 23,000 pages:
http://www.l.google.com/search?hl=en&q=%22script+src%3Dhttp%3A%2F%2Fwww.2117966.net%2Ffuckjp.js%22&btnG=Google+Search&aq=f [google.com]
I haven't counted the Google-provided list. In theory some of those sites/pages have already been cleaned up, and they are reported 'cuz that was the last time Google spidered them.
It's called a hosts file (Score:2)
Re: (Score:2)
It may as well have been just the headline.
Re:It's called a hosts file (Score:4, Informative)
http://www.avertlabs.com/research/blog/index.php/2008/03/12/another-mass-attack-underway/ [avertlabs.com]
Re: (Score:1)
Re: (Score:3, Insightful)
Great Threat Research (Score:5, Insightful)
In the old days it was easy to avoid malicious sites. Now even your neighbor could be the terrorist... err..I mean.. even sites you know and trust can become compromised.
At least this threat researcher offered a calm analysis with plenty of advice about how to avoid such attacks without recoiling from the web in fear.
MUST BUY MCAFEE...
Wait, so we know the physical location... (Score:2)
Re: (Score:2)
No. Killing them that way is not slow and painful enough.
Re: (Score:3, Funny)
Re: (Score:2)
Good point.
Of course the only sane way to clear the entire internet of all malware of any kind...
is to explode many nuclear weapons in orbit thus frying most of the electronics on the planet.
Lets call that "Plan B".
A number. (Score:2)
Re: (Score:1, Offtopic)
Re: (Score:2)
That said, you are otherwise correct.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Futhermore a government is just a group of people who make policy and rule a certain way. If yours does so honorably (for the most part) and
Re: (Score:2)
Futhermore a government is just a group of people who make policy and rule a certain way. If yours does so honorably (for the most part) and you helped elect and be a part of the process then why not be proud?
Rac
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Pages != Sites (Score:3, Interesting)
What's vulnerable? (Score:1)
Re:What's vulnerable? (Score:4, Funny)
Yes.
Impressive! (Score:3, Funny)
Re:Impressive! (Score:5, Funny)
http://www.auntiemomo.com/cakeordeath/d2ktranscription.html#history [auntiemomo.com]
Isn't this the obvious result .... ? (Score:5, Insightful)
So the next trick was to try to make removal difficult or impossible by infecting a PC with a "downloader virus". That way, the virus itself would try to avoid detection, but silently download and install spyware from various sites around the world. The user might figure out he/she was infected with the spyware and try to clean it with a remover, but it would keep coming right back, as the original virus kept re-downloading the stuff.
This led to popular anti-virus packages starting to blur the lines between spyware and virii (in cases where the company in question didn't have a specific anti-spyware product ready to sell you). They'd just attempt to clean ALL of the stuff up. Others wanted you to run 2 distinct programs together to protect against both types of threats. In any case, all of this confused a lot of people -- but also made them catch on that a lot of this stuff appeared to be impossible to clean ONLY because of that "downloader trojan horse" trick.
After they started "wising up" and unplugged their Inet connections while doing all the virus and spyware removal
The current ploy of injecting the stuff from normally benign web sites is pretty much the "next logical step" for them. Doesn't surprise me a bit. I think we'll continue to see more and more of this, too. After all, this attack has several vectors. DNS server entries could be spoofed, redirecting people to fake sites. Web servers with security flaws could be compromised, and modified code loaded directly onto them. Or maybe, legitimate sites will unwittingly host infected ad banners down their pages, paid for by "advertisers" with motives other than really caring if you view the ad's visible content?
Re: (Score:3, Insightful)
Personally, I suspect that we will start seeing DNS cache and Route poisoning attempts become much more commonplace. Particularly after the whole "YouTube gets 'knocked offline' because of an improper route broadcast by a piss-ant totalitarian country" issue we had in recent weeks.
I would bet good money that there were criminals rubbing their hands together with glee over the idea of dumping MILLIONS of users to a malware server s
Re: (Score:1)
can anyone tell me the checksum of the code? (Score:5, Informative)
A google search for threeseas.net/blogger/log/cache/ (cache being the directory that contained the files [past tense]) shows up about 4500 site pointing to one of the files in that directory. Some of the findings are even sourceforge sites and you can tell they have been hacked as well. In other words there are a lot of hacked sites besides mine.
I notified google this morning and my host has already removed the files from my site as the owner and group were set that I couldn't do this myself.
anyways rather that posting the code, a check sum would be better of the code starting with teh word "function" to the end of the code.
Re:can anyone tell me the checksum of the code? (Score:4, Informative)
Sounds like it would be rather difficult to get a checksum for you, sorry.
Re: (Score:1)
Save us (Score:5, Funny)
McAfee Avert Labs described the assault as "one of the largest attacks to date of this kind".
The attack serves as a reminder that even trusted websites can be malicious, McAfee warned.
"Often you hear warnings about not going to untrusted sites," said Craig Schmugar, threat researcher at McAfee Avert Labs."That is good advice, but it is not enough."
McAfee Avert Labs first spotted the attack on 12 March.
I wonder who can sell us some sort of software to guide us out of this maze of evil webpages?
series of tubes (Score:1)
If this is true... (Score:2)
That's right. 911,000!
Oh No! My Pwecious Mac! (Score:1)
Nevermind.
Good luck, lads.
Re: (Score:2)
Meme? Absolutely i for internet savvy (Score:1)
I would appreciate their email addy if you can manage that as well.
I've had to put up with 'Absolutely' in the 90's and now 'meme' for the next decade, as well as iAddyourwordhere.... for just too long.
New (?) redirect attack blogs??? (Score:2)
I've noticed through some search terms found on Google Trends that there are bunches of apparently fake "blogs" on blogspot. Here's an example:
http://forniagill.blogspot.com/2008/03/what-time-is-it.html [blogspot.com]
Clicking on the "what time is it scandal" "video" redirects toward a site Firefox flags for malware downloading (even though I'm on Linux -- thank you 'Fox
There seem to be hundreds of these random malware blogs out there. Is this an old phenomenon? Thx.
Re: (Score:1)
THANKS A LOT, "SECURITY"! FOR NOTHING! (Score:4, Insightful)
If we knew that, we could reject any requests from there at the application OR server level, or even both.
And when they move to a new server, same thing. Of course, it would be helpful to have signature(s) of the code as well, but let's STAMP OUT the immediate problem, then worry about potential problems.
I know the "security" companies are commercial interests. But there are times when responsibility toward your community trumps making an enormous profit.
Re: (Score:1)
Good Luck
extremeSecurity.blogspot.com
Re: (Score:1)
Re: (Score:1)
ok, so how do I block China (Score:2)
Re: (Score:1)
http://www.okean.com/sinokorea.txt [okean.com] http://www.okean.com/sinokoreacidr.txt [okean.com]
note that below just block port 25
wget http://www.okean.com/antispam/iptables/rc.firewall.sinokorea [okean.com]
wget http://www.okean.com/antispam/iptables/rc.firewall.china [okean.com]
But... (Score:2)
Re: (Score:1)