Jamie Oliver's Website Serving Malware 125
jones_supa writes While routinely checking the latest exploited websites, Malwarebytes came across a strange infection pattern that seemed to start from the official site of British chef Jamie Oliver. Contrary to most web-borne exploits we see lately, this one was not the result of malicious advertising but rather carefully placed malicious JavaScript injection in the site itself. This, in turn, has been used to serve visitors a delicious meal consisting an exploit kit downloading the Dorkbot trojan. Malwarebytes has contacted the administrators immediately upon discovery of this infection.
Re: (Score:3)
It's a fucking recipe for a pork roast.
It doesn't need to be anything more than HTML and images.
What if I want to convert to/from metric units? With Javascript I can click a button and have the page change all the values. Without Javascript I'd have to click a link instead!
What if I want to adjust the number of servings? With Javascript I can type in a value for servings and have the page tell me I need 2 and a half eggs. Without Javascript I'd have to type in a value and then hit the Enter key or click a Submit button!
What if I want to read user comments about the recipe? With Javascript, I can
Re: (Score:1)
Re:Is javascript dangerous? (Score:5, Informative)
Browser Javascript is already limited in what it can do and access.
And in this case even if you had NoScript installed (which is different from turning Javascript off entirely in your browser) and the main Jamie Oliver website whitelisted you'd still have been protected because what the JS was doing was creating an iframe to another site and loading Flash/Silverlight/Java exploits inside of that.
And note that even with a compromised site where they were able to inject their own JS that they still had to rely on Flash/Silverlight/Java rather than just Javascript to download and run the trojan.
So to answer your question: No, Javascript isn't really dangerous. Poorly written browser plugins are.
Re:Is javascript dangerous? (Score:5, Insightful)
No, what's dangerous is software that doesn't silently auto update.
JavaScript vs Java vs ActionScript is largely irrelevant. Web browsers routinely ship fixes for dozens of JS sandbox escapes in every update they release. Web sandboxes aren't made of magic that is unavailable to other technologies. The reason most exploit kits still target Flash and Java is that modern web browsers keep themselves up to date a lot more aggressively than those plugins do/did - typically not asking for permission any more. If you dig in you'll usually find these exploit kits are exploiting bugs that were found and patched years ago. But they still work because some non-trivial fraction of the userbase always dismisses auto update requests.
In case you don't believe me, consider that in 2014 Java had no zero day exploits at all. But some people are still vulnerable to bugs from 2012. The ask forgiveness not permission auto update policy was pioneered by Google and unfortunately took a long time to become accepted as the standard due to the old mindset, especially amongst tech geeks, of "my computer is my castle".
Re: (Score:2)
On the other hand, where I work several of the Java apps that the business runs on are (stupidly or lazily) coded to work on specific
Re: (Score:2)
Yes, that seems like a remarkably common problem and I'm not sure how people manage that. Serializing objects to the database? I guess if vendors get enough customer pressure to work better with Java updates they might put some effort into it, eventually.
But then the Java security holes are all sandbox escapes. You aren't using the sandbox for some enterprise time tracking app. So the need to update is less.
Re: (Score:2)
So quit using stupid brittle Java apps!
As a lowly drone in this massive corporate machine I don't really have that option.
Re: (Score:2)
The reason that they don't offer auto-update is that, if they did, Adobe/Oracle wouldn't be able to offer you crapware along with your update, pre-checked for your convenience (Norton something and Ask.com Toolbar, respectively.)
Re: (Score:2)
It was tried. Doesn't work. Lots of people don't even read security alerts. They just immediately find the X or close or cancel button and click it without even reading the thing they are dismissing.
The amount of time your average user wants to spend on maintaining their computer is zero. They have no notion that a computer is a thing that must
Re: (Score:2)
Zero day means the bad guys find out before the good guys do.
Re: (Score:2)
I use it and love it. It's not perfect by it
Re: (Score:2)
NoScript?
That has the added advantage of making 99% of websites unusable, thereby forcing you to do some work instead.
Re: (Score:2)
uh... bollocks. Look up "Barbecoa".
Re: (Score:3)
Shouldn't be up to the Javascript website developers to make sure it's safe (OBVIOUSLY!)
It's up to those implementing the browsers with Javascript engines. It should be no more dangerous than any basic HTML if they got the security right.
Re: (Score:3)
Re: (Score:1)
But, the real difficulty for the attacker is to inject some JS into a page in the first place. This is (usually) not easy!
Why are we not able to lock down our javascript files before they get sent to the browser? Sure, inline scripts could be exposed, but anything served as .js should have a header that tells the browser whether to give me all the juicy bits of the javascript running on the page ... or not.
Really, why should someone be able to see all the javascript on your site just by hitting F12? Shouldn't we be able to turn this off, ala a header in .js files, so that we can use it for debuggings/development, but disable
Re:Is javascript dangerous? (Score:5, Informative)
Your post is a hot mess.
So, you want Javascript to be secure, but not allow the user downloading it to be able to see what they are running? Do you even understand how Javascript works in a browser beyond "hitting F12?" For the love of WTF, they are not "seeing the Javascript on your site", you are letting them DOWNLOAD the Javascript to their computer and then run it.
How, precisely, do you expect an interpreted text file to be hidden from a web browser that downloads and executes an interpreted text file? And more importantly, WHY would a browser want to let you do that, unless to obscure what you are trying to run on a user's computer?!?
The sum total of Javascript exploits is a browser that allows Javascript exploits. If they were implemented correctly there would be no problem.
Re: (Score:2)
Re: (Score:2)
" you are letting them DOWNLOAD the Javascript to their computer and then run it"
In a simple form, yes. Sometimes, however, that involves a rats-nest of includes, "minified" files (all whitespace stripped, sometimes variables stripped of any useful naming as well), etc.
It wouldn't be hidden from the browser, but obscuring Javascript isn't exactly hard, and "exploit" could just mean something that's a useful situation in situation X but bad in situation Y (accessing a microphone/camera, for instance).
Re: (Score:2)
Not sure what the point of your post was. Clearly you and I understand how Javascript works but the OP doesn't. Read the OP. I assume he doesn't know about Javascript obfuscation, etc, or how a browser executes Javascript in general. Maybe you meant to reply to him.
And your example of using a camera is as I said all up to the browser implementation. As in, if it asks you very clearly and without the possibility of the JS code to obscure it if you want to let the code use a camera, it's implemented c
Mobile permissions (Score:1)
The sad part is that Blackberry, which preceeds both iOS and Android devices, did the permissions/request model best. Unfortunately they underestimated the power of "apps" and a touchscreen, and for whatever reason the other vendors went with a more lax permissions model (that said, Android is decent when rooted with some 3rd party stuff, but it's hardly an option for the average person).
Re: (Score:2)
Yeah, but saying Blackberry in the distant past did permissions best is like saying your toaster did permissions best of all your kitchen appliances. With great features comes great responsibility...
Re: (Score:1)
Except that BB STILL has one of the best permissions models...
And my toaster DOES have the best permissions. Toast goes in, it toasts. No internet access :-)
There's no reason other smartdevices couldn't have used a similar permissions model to BB.
Re: (Score:2)
And my toaster DOES have the best permissions. Toast goes in, it toasts. No internet access :-)
I wouldn't know, I dumped my "feature toaster" years ago for a toaster oven...
Re: (Score:1)
Ironically, the one thing that I've toaster ovens don't do quite very well is make toast. The only one I saw that did toast half decently was my grandmother's toaster oven that actually had a toast slot that popped open in the top (and the burners tilted when it was in "toast mode").
Re: (Score:2)
My toaster oven makes toast almost as well as my iPhone makes phone calls. Which, with AT&T, usually burns everyone involved most of the time...
Re:Is javascript dangerous? (Score:5, Informative)
Re: (Score:2)
" it cannot impact directly your speed,"
Bullshit, poorly-done JS can damn near freeze your computer.
Re: (Score:2)
" it cannot impact directly your speed,"
Bullshit, poorly-done JS can damn near freeze your computer.
No. Poorly implemented browser. Eg chrome gives you a way to calm down abusive JS scripts.
Re: (Score:2)
Chrome fails more than 50% of the time when it crashes on JS on anime sites I view. Whole browser locks up. Chrome can't even deliver a warning.
Also, Chrome's default security sucks.
Re: (Score:2)
well yeah you know it's not supposed to be able to install random stuff on your computer any more than a html element can. so is there a way to make javascript safe? yes.
the question you should be asking is can you make the browser safe though.
Re: (Score:2)
Yes. Block all ads and then disable javascript.
Re: (Score:2)
It seems that javascript is a common factor in most malware infection mechanisms. Is there a way to make javascript safe?
0: Don't write and host your own malicious javascript.
1: Don't host third-party javascript.
2: Don't host third-party content without sanitizing it to ensure it doesn't cause users to load other third-party shit.
1 & 2 can be combined into a simpler, more secure rule: Don't host third-party content.
Web site gets hacked... (Score:2)
...news @ 11...
Re: (Score:3)
Re: (Score:2)
NB
Re: (Score:2)
You can! You just have to hit "Preview" to enable that functionality.
Re:Web site gets hacked... (Score:4, Funny)
Why, always, 11, ... ?
Because most ordinary news goes to 10, our news goes to 11.
Re: (Score:3, Informative)
Why, always, 11, ... ?
In the US, the traditional time for networks to show their nightly news is 11pm, after the 'prime time' entertainment and kids have gone to bed. Any unsold prime-time commercial slots are filled with teasers for these news programs, generally of the form "Shocking ways that Foo can kill you! Details at 11," or "Weird tricks to save you money! News at 11."
Re:one word: Barbecoa (Score:4)
yes I am bitter because at 36 I applied and was told I was too old for *any* position within Jamies Italian Kitchen.
Cooks read Slashdot, that's good news!
Re: (Score:2)
isn't that profoundly illegal?
I mean, overtly stating that you are 'too old' ? I don't think even a 36 year old woman would be told that if she applied at Wet Seal.
Re: (Score:2)
yes but what are you going to do when you have no money and it costs a fucking fortune to file a claim in the employment tribunal?
Re: (Score:2)
A 36-year old going for a minimum wage job? Age discrimination? Legal aid? What planet are you from?
Nobody gives a fuck.
Re:one word: Barbecoa (Score:4, Informative)
People over forty are a protected class in the US, and can't be legally discriminated against (there are exceptions to this, like the military). But a thirty six year old person can be openly discriminated against without legal repercussion.
Re: (Score:2)
Ah, thanks for pointing that out, had to look it up.. You'd think the young would suffer from age discrimination just as much as the 40 and up crowd.
(also, yep.. it would make sense that the gentleman is in the UK. Even before mentioning 'tribunal' :) )
Re: (Score:1)
You'd think the young would suffer from age discrimination just as much as the 40 and up crowd.
When it comes to employment in the US, the young are expected to work for peanuts in exchange for gaining experience. They also tend to be mostly part-time, owing to other responsibilities like schoolwork, and therefore aren't eligible for those pesky socialist expenses like vacation time or health insurance. The 40 and up crowd faces discrimination because they already have the experience to demand fair compensation (and benefits) for their time.
Employers love young workers. If more companies could figure
Re: (Score:3, Informative)
That should be familiar to any Oliver fans and hardcore critics alike. For those in neither camp, Barbecoa was Oliver's butchery that was shut down last June after receiving an "A Hazardous" rating from the Food Standards Agency following complaints of food poisoning form several of his restaurants that also received poor FSA ratings for general hygiene. Oliver was also fined £17,000 over this scandal, consisting of just one specimen charge of violating the Food Safety Act, which is pretty fucking disgusting after his ironically calling the US fast food industry out for unsafe kitchen practices. He should have been shut down altogether. Oh, semi-insider info: I have it on very good authority that his restaurants have a higher staff turnover than practically every other sector. They are hellish places to work in. Certainly not worth the wage slavery. The management expect new staff to already know how it all works (in Oliver's eclectic kitchen system!?), training is not only nonexistent it's an inside joke that "training" is a curse word. Most of his staff are school leavers. The only ones over the age of 18 are upper management.
[ citation needed ]
Re: (Score:1)
google "Jamie Oliver food safety", I'm not doing all the fucking legwork because you're too fucking lazy.
Re: (Score:1)
too **** lazy.
Indeed, some posters here omit the anchor tag that enhances the discussion.
Re: (Score:3)
That should be familiar to any Oliver fans and hardcore critics alike. For those in neither camp, Barbecoa was Oliver's butchery that was shut down last June after receiving an "A Hazardous" rating from the Food Standards Agency following complaints of food poisoning form several of his restaurants that also received poor FSA ratings for general hygiene. Oliver was also fined £17,000 over this scandal, consisting of just one specimen charge of violating the Food Safety Act, which is pretty fucking disgusting after his ironically calling the US fast food industry out for unsafe kitchen practices. He should have been shut down altogether. Oh, semi-insider info: I have it on very good authority that his restaurants have a higher staff turnover than practically every other sector. They are hellish places to work in. Certainly not worth the wage slavery. The management expect new staff to already know how it all works (in Oliver's eclectic kitchen system!?), training is not only nonexistent it's an inside joke that "training" is a curse word. Most of his staff are school leavers. The only ones over the age of 18 are upper management.
[ citation needed ]
http://www.dailymail.co.uk/new... [dailymail.co.uk]
Re: one word: Barbecoa (Score:5, Informative)
Ah, yes, that gospel of truth, The Daily Mail.
http://www.thetimes.co.uk/tto/... [thetimes.co.uk]
http://www.independent.co.uk/n... [independent.co.uk]
http://www.telegraph.co.uk/foo... [telegraph.co.uk]
http://www.standard.co.uk/news... [standard.co.uk]
http://www.theguardian.com/lif... [theguardian.com]
http://www.news.com.au/enterta... [news.com.au]
Re: (Score:2)
Ah, yes, that gospel of truth, The Daily Mail.
Every now and then, even the Daily Fail gets something right.
Link (very odd criticisms, too) (Score:5, Interesting)
Jamie Oliver's butcher's forced to close after hygiene inspection [telegraph.co.uk]
Key bits from the article: "the score for the January 8 inspection is listed as of 1 out of five with the comment: 'major improvement necessary'." and "one of only 19 out of 1,659 food outlets in the City to receive an 'A hazardous' rating".
This sounds pretty damning and pretty embarrassing. That said, there are some odd things. One of the complaints was mold on aging beef, but - depending on what you are doing - mold is part-and-parcel of the process (and the butchery claims that this was the case). Another funny point: the butchery voluntarily closed following the inspection to fix the issues mentioned. It reopened "several hours" later. If the issues could be fixed in a few hours, they were pretty much cosmetic problems.
So what to think? I figure it's 50/50 whether there were real problems, or whether this was a politically motivated inspection. Or maybe the inspector didn't get his free steak.
Re: (Score:2, Interesting)
Oliver has pissed off a lot of people in the processed food industry both sides of the Atlantic.
The butchery voluntarily closed down for less than 24 hours before it was given the all clear again. But that doesn't stop the processed food industry shill and celeb-hating people dragging the same thing up to discredit the man.
It doesn't matter whether your like the cockney twat or not, the shit served in schools is disgraceful and the 35p budget per kid is terrible, especially when the same dinner is charged o
Re: (Score:1)
[ citation needed ]
[ this is slashdot you monkey, learn to use google ]
Re: (Score:2)
citation *not* needed (Score:4, Informative)
[citation not needed]
The citation isn't needed not because that rant-with-a-personal-slant didn't require citation, but because it's off-topic. I'm not sure how his comment got modded 'Informative' - unless this is not Slashdot, but Buzzfeed, or Us magazine or some other gossip rag.
Without defending whatever nastiness went on in his restaurants, how does that relate to malware being on a website? It's highly unlikely that he personally oversees the restaurants, and even less likely that he personally oversees the website. At best one can fault him for having certain ideas about how to run things, that in turn lead to both restaurateurs and webmasters cutting corners and dropping the ball.
What's next? A report comes out about Forbes being hacked ( http://www.forbes.com/sites/th... [forbes.com] ) and we point out how they let an article that was then vastly criticized by its subject ( The Oatmeal - http://theoatmeal.com/blog/tes... [theoatmeal.com] ) through as some sort of 'goes to character and general reputation'?
Re: (Score:2)
You are new here so you don't understand the fact that Buzzfeed and all the rest got their commenter styles from Slashdot.
This place is the birthplace of all that. Learn your history N00b!
And if we catch you reading the article again before posting, there is going to be trouble with Taco and the gang giving you a visit...
Wait, we don't have Taco and the gang anymore.... Damn this place has gone down hill....
Re: (Score:2)
I think that's serving up a different kind of "virus"...
Jamie serves up malware (Score:1)
Do you want fries with that?
Ain't surprised (Score:2)
This doesn't surprise me. I run modsecurity WAF and iptables, yes I know but iptables does the job for now, with custom rules and logging policies and it is amazing to see how many so called legitimate sites have been owned.
I used to contact site admins and participate in exchanges of offending IPs but I gave up a long time ago to run my own countermeasure system.
Boy we went a long way since the beginning with regards to that.
Re: (Score:2)
iptables does the job for now, with custom rules and logging policies and it is amazing to see how many so called legitimate sites have been owned
Hmm so with iptables you can detect and block JS injections in a page...?
Re: (Score:2)
yes but it is much easier to to it with mod_security, as mentioned in my OP, for my users and to make sure we ain't serving any.
Re: (Score:2)
Re: (Score:2)
A lot of people hate GoDaddy for good reasons, but they do respond to that kind of stuff fast. I have had far more trouble with the little guys than the big behemoth.
Re: (Score:2)
That's a good one! ;-)
I am a French chef from France and it dates back to around 1500; we used to say that all an English chef could cook was oxtail and the like. Of course, this is full of BS but hey, this constitute sane competition.
Re: (Score:2)
all an English chef could cook was oxtail and the like. Of course, this is full of BS
You mean an English chef cannot even cook an oxtail?
Re: (Score:2)
all an English chef could cook was oxtail and the like
Actually, before Jamie Oliver meddled in, the English chefs at schools could serve up a wonderful meal of Turkey Twizzlers, Heinz baked beans, fresh, right out of the can, and chips (UK), French Fries for the rest of the world. "French" Fries were actually invented in Belgium, which any Belgian will tell you, again and again. And then one more time, again. Eating fries in Belgium is quite a treat, because they offer different sauces that you can have on top. Not just the mundane ketchup or mayonnaise, b
Re: (Score:2)
Luckily you mentioned 'around 1500' so we knew this was Old Shit.
Re: (Score:3)
That's a good one! ;-)
I am a French chef from France and it dates back to around 1500; we used to say that all an English chef could cook was oxtail and the like.
Since we're here in the offensive zone.......
In an ideal world ...
the policemen would be English
the car mechanics would be German
the cooks would be French
the innkeepers would be Swiss,
and the lovers would be Italian
In a living hell ...
the policemen would be German
the car mechanics would be French
the cooks would be English
the innkeepers would be Italian
and the lovers would be Swiss
How will Morrissey comment this? (Score:1)
Worm:Win32/Dorkbot.A Description .. (Score:4, Informative)
Re: (Score:2)
Pretty rude to name malware after a well-established series [dorkbot.org] of tinker meetings/presentations (that's been going on since before anyone started using the word "maker.")
Re: (Score:2)
(in a non-Dune related context that is)
Re: (Score:2)
Pretty rude to name malware after a well-established series [dorkbot.org] of tinker meetings/presentations (that's been going on since before anyone started using the word "maker.")
Sounds like dorkbot has a legal course of action for trademark infringement and tortuous interference with business since no one would want to go to their meetings for fear of catching some virus.
BTW - what is the HTML tag for sarcasm for the humor impaired?
Re:Worm:Win32/Dorkbot.A Description .. (Score:5, Funny)
Great, no support for Mac and Linux. Again.
Hmmm (Score:1)
Re: (Score:2)
If you're perusing the net without some form of basic protection, you're doing it wrong anyway
( Bare minimum being: NoScript, Ghostery and Adblock, or their equivalents )
( Paranoia level being: The above plus some flavor of Linux in a VM via a Tor relay, VPN service or proxy and a dozen other addons )
Re: (Score:1)
Re: (Score:2)
Please stop recommending Ghostery, it is made by an advertising firm
What do you contend that it does wrong?
Re: (Score:2)