Feeds

DoubleClick undergoes security audit after hack attack

Security experts say firm should consider "pulling plug on servers" until flaws are fixed

  • alert
  • submit to reddit

SANS - Survey on application security programs

Internet advertising firm DoubleClick has denied reports that the security of its Web servers has been compromised by vulnerabilities which lay unnoticed for the last two years.

French security site Kitetoa.com claims that a flaw with the doubleclick.net Web server, which runs Microsoft's IIS, means hackers had backdoor access to confidential data. DoubleClick denies this but admits it is undergoing a security audit after what it said were unsuccessful attacks by hackers last week.

According to Kitetoa, missconfigured Web servers at DoubleClick allowed the installation of a Trojan horse program on the firm's systems.

A screenshot published by Kitetoa appears to show the Web servers have been tampered with and that a file called eEyehack.exe uploaded onto its servers on April 29 1999. It points to an exploit first described by security consultants eEye Digital Security as the mechanism of the attack.

Network security consultant Paul Rogers, of MIS Corporate Defence, said there is no firm evidence eEye's exploit, which allows Trojans to be uploaded onto servers, was used against DoubleClick. The date of the file was before the publication of the eEye advisory and the size of the file, which might be a Trojan, does not correspond to any well known backdoor program.

Rogers said far firmer evidence that DoubleClick's servers are insecure is provided by another screenshot Kitetoe.com has obtained. This apparently shows username and passwords protecting DoubleClick's Abacus server, its market research division.

"If I was able to obtain this whilst doing an penetration test for one of my clients I'd advise them to pull the plugs on their boxes," said Rogers. "DoubleClick should consider running their services from a different platform whilst damaged host servers are repaired. It might also consider restricting access to services."

A spokeswoman for DoubleClick denied that its servers had been compromised for the last two years but admitted that it was in the process of conducting a full security audit after an attack by hackers last week. She stated that these attacks were unsuccessful.

In a statement on the attacks sent to The Register, DoubleClick said: "Over the last week there have been unsuccessful attempts made to hack into DoubleClick's servers. DoubleClick is now undergoing a comprehensive security audit, including the expertise of external security professionals and engineers, to fully ensure the continued integrity of our servers." ®

External links:
Kitetoa.com

3 Big data security analytics techniques

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
Number crunching suggests Yahoo! US is worth less than nothing
China and Japan holdings worth more than entire company
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.