Feeds

Hackers turn Cleveland into malware server

And Computer Associates too

Internet Security Threat Report 2014

Tens of thousands of websites belonging to Fortune 500 corporations, state government agencies and schools have been infected with malicious code that attempts to engage in click fraud and steal online game credentials from people who visit the destinations, security researches say.

At time of writing, more than 94,000 URLs had been infected by the fast-moving exploit, which redirects users to the uc8010-dot-com domain, according to this search. Security company Computer Associates was infected at one point, as were sites belonging to the state of Virginia, the city of Cleveland and Boston University.

"This is a wide variety of sites that have been impacted," said Mary Landesman, a researcher for ScanSafe, a company that provides real-time information to clients about malicious sites. "It's a real in-your-face example of what we see everyday. It's really time for companies that have a vested interest in a web presence to take a hard look at what their security posture is."

Malicious hackers were able to breach the sites by exploiting un-patched SQL injection vulnerabilities that resided on the servers, according to Johannes Ullrich, CTO for the SANS Internet Storm Center. The injections included javascript that redirected end users to the rogue site, which then attempted to exploit multiple vulnerabilities to install key-logging software that stole passwords for various online games, he and other researchers said.

In many respects, the attack resembles one that took place early last year on websites belonging to the Miami Dolphins football team just in time for the Super Bowl. Miscreants behind that attack exploited a bug in a content creation tool called DreamWeaver, which left much of the code on the website vulnerable to SQL injections. The attackers, which over the past year have struck other sites, were able to exploit the vulnerabilities using scripts that scour servers for the buggy code.

Ullrich said he was unsure where the vulnerability lies in the latest round of attacks.

Visiting uc8010-dot-com set off a chain of redirections that tried to use patched vulnerabilities to install key-logging software. Ullrich said he observed the sites using an old RealPlayer vulnerability. Roger Thompson of Exploit Prevention Labs, said here end users were also treated to a Windows vulnerability Microsoft patched in late 2006.

According to Landesman, the exploits forced end users to visit sites that pay third parties a fee in exchange for sending them traffic. She speculates the attackers signed up as affiliates of the sites and then profited each time an end user was infected. The malware also installed keyloggers on end user machines that stole passwords to various online games, Ullrich said.

He said the uc8010-dot-com domain (we don't recommend readers visit the site) was registered in late December using a Chinese-based registrar, indicating the attackers were fluent in Chinese.

As we've said before, end users should make sure browsers, browser plug-ins, media software and other applications are updated. Secunia's Software Inspector is one good way to do this. Also helpful is the use of the Firefox browser with the NoScript plug-in, which helps fortify users from many javascript attacks. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.