Feeds

Firm at heart of biggest oil spill spews toxic web attack

Transocean's deepwater.com hosts malware exploits

Boost IT visibility and business value

Transocean, the offshore drilling contractor at the center of the world's biggest marine oil spill in the history of petroleum production, has been caught spewing a virtual sort of toxic sludge, according to a report released Thursday.

Researchers at web security firm Websense said deepwater.com, Transocean's official website, has been hosting malicious exploit code that attempts to install malware on the machines of people who visit the site. The researchers counted at least two separate attacks included in several deepwater.com pages that exploit known vulnerabilities in Microsoft's Internet Explorer browser and Adobe's Flash media player.

Only 16 percent of the top 44 antivirus programs detected the latter exploit, the Websense report said, citing this analysis from Virustotal. The exploit code is stashed in invisible iframe tags planted on Transocean's site, the report said.

As of 10:30 am California time, about 26 hours after the exploit code was first detected, the attacks were continuing unabated, Patrik Runald, a senior manager for security research at Websense, told The Register. They stopped shortly after The Reg asked a Transocean spokesman to comment.

“We don't know exactly how the compromise happened but as the attackers were able to upload the exploit files to the server it's not a SQL injection attack (which usually involves redirection to an external server),” he wrote in an email.

One of the world's biggest offshore drilling contractors, Transocean operated the Deepwater Horizon oil rig, which caught fire on April 20, 2010 and spilled some 205.8 million gallons of oil into the Gulf of Mexico. Computers on the rig had a history of malfunctions, a chief engineering technician on the rig told investigators last year.

A spokesman for Transocean said members of the company's IT department managed to remove the exploit code from the company's servers, a claim Runald confirmed. The spokesman didn't say if the deepwater.com website has ever been reviewed by outside security auditors.

The Websense report is here. ®

This post was updated to report that the exploit code has been removed.

Boost IT visibility and business value

More from The Register

next story
Computing student jailed after failing to hand over crypto keys
Sledgehammer once again used to crack a nut
USA to insist on pre-flight mobe power probe
Prove it works or it can't come aboard flights to USA
Brit celebs' homes VANISH from Google's Street View
Tony Blair's digs now a Tone-y Blur
Doctor Who season eight scripts leak online
BBC asks fans to EXTERMINATE copies before they materialise
Insecure AVG search tool shoved down users' throats, says US CERT
Sneaky 'foistware' downloads install things you never asked for
Russian MP fears US Secret Service cuffed his son for Snowden swap
Seleznev Jnr is 'prolific trafficker in stolen credit card data', it is alleged
'I don't want to go on the cart' ... OpenSSL revived with survival roadmap
Heartbleed-battered crypto library reveals long path back to health
That 'wiped' Android phone you bought is stuffed with NAKED SELFIES – possibly
Infosec bods sound alarm after copping eyefuls of nudie pics
prev story

Whitepapers

How modern custom applications can spur business growth.
In this whitepaper learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
The Power of One eBook: Top reasons to choose HP BladeSystem
Only the Power of One delivers leading infrastructure convergence, availability and scalability with federation, and agility through data center automation.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximizing your infrastructure through virtualization
Virtualization continues to be one of the most effective ways to consolidate, reduce cost, and make data centers more efficient.
Build a Business Case: Developing Custom Apps
In this whitepaper learn how to maximize the value of custom applications by accelerating and simplifying their development.