Injection Attacks Continue

In my line of work I come across websites that have been hacked and code is injected leading to a website loaded with malware ready to take advantage of people who don't patch their PC's. Today was the website executivehomemaker.com. Hidden inside this legitimate site is a redirect to hxxp://iwdown.com/inc/e.js. A site hosted in China.

This is just another in a long line of sites with vulnerabilities that allow the bad guys to take advantage of the casual surfers. They don't patch, they probably click on links in spam e-mails and on and on. My last search on the iwdown site shows 135,000 sites with these injections. Click here an see the search results.

Stay safe and have a fabulous weekend and ROCK CHALK JAYHAWK!

Asprox Botnet is Back!!

The Asprox botnet has come back to life with malicious injections into legitimate websites. Click here to see the Google search on the malicious injection. The site hosting the malicious code is h!!p://www.wmpd.ru. Now let me warn you, DO NOT CLICK ON THESE LINKS!!! These websites in this search have a vulnerability that allows attackers to inject this code. They need to close the vulnerability or they will continue to have possible attacks on their websites.

It is a good idea to avoid these sites. If your PC is not patched with all the software you have installed, then your PC can fall victim to the attackers and your PC can then be in control of the attacker and their botnet.

Hope everyone is having a safe weekend and I hope it is warmer where you are than here in the state of Kansas.

Monster.com/USAJobs.gov sites Compromised

Read on Internet Storm Center's website that Monster.com and USAJobs.gov had their databases compromised. Click here to read the details from ISC. Information from these databases was stolen. USAJobs.gov's database is administered by Monster. Click here for USAJobs.gov post detailing the information they know. Click here for Monster.com's post detailing the information they know.

So what are the dangers? Thing targeted spear phishing attacks to follow on the heels of this compromise. Those on Monster and USAJobs will now be in the cross hairs of malicious attackers. From the press releases, login credentials were also taken so if you are one of those who likes to use the same password for many things, as Joel Esler states in the ISC Diary posting, might be a good time to go change that password on yourbankhere.com. We've talked about not using the same password for everything, especially financial accounts.

Small Credit Unions Equal Compter Security Risk

OK, it has been a long time since I've posted a story on my blog. I write about computer security. Today's story talks about a couple of small local credit unions here in my town of Topeka. Educational Employees Credit Union and Kansas Super Chief Credit Union sites had what is called a code injection attack on their websites. The site that their customers were re-directed to was hxxp://ytgw123.cn (Don't go to this site. It will attack you PC with exploits.) The attack happened somewhere around September 26th, 2008.

So how did this attack happen? First, the web sites were not coded securely which allowed the criminal attacker to inject this code into the online banking sites for these two credit unions. The attacker didn't actually access the credit union's customer accounts. However, if any of their customers innocently went to either credit union's website, they were re-directed to this malicious site. If not properly patched, these customers probably now have malicious code installed on their PC that could be a password stealer, keylogger, and is now a robot which means someone with bad intentions now controls your PC.

I've been told that the problem has been corrected but I have my doubts. Since I have an account at Educational Employees Credit Union, I will be watching this closely. The problem I see is that this was not reported and customers of EECU and KSCCU have spyware or malware installed on their PC and may not realize it.

Hopefully the company that is contracted to create and maintain these credit union's websites has found the actual vulnerability in their own code and closed this hole. From my experience in computer security, code developers are trained to write code quickly to add to a companies bottom line. They are not trained to code securely. I believe that this situation is so common and customers of these smaller banks and credit unions who have to contract with companies who develop and write code are putting the customers of these institutions in danger of criminal hackers stealing login credentials for their banks and credit union's accounts. I will be watching my credit union. Maybe you should too!

Judge Lifts Gag Order on MIT Students - MBTA

A judge has lifted the gag order on the 3 MIT students who were to present their talk on hacking the CharlieTickets. There appeared to be other problems with physical security too. I wish I could have heard these guys give their talk at DefCon in Vegas. Oh well.

This doesn't mean that the MBTA isn't going to try and go after these guys with criminal charges. I'm sure it will be drawn out for sure. Click here, and here for links to this story. Have a great Hump Day tomorrow!

What Would a Hacker Want with my PC?

I review SANS Internet Storm Center everyday to try and keep up with the current “bad guy” happenings that the Internet Storm Center reports back. They are a source of sharing information with the Security Community and let you know what is happening currently. The Storm Center has somewhere around 40 people who rotate 24 hour shifts and it is manned continually. The link I have in the first line of this post is the story I’m using as my source for this posting.

Have you ever asked the question, what would a hacker want with my PC? You may not bank online and you may not shop online, but you need to know what a hacker sees in your PC. Kevin Liston wrote this post to remind us that when you have a presence on the Internet, you do have things of value to the criminal mind. You have a CPU, Memory, Hard Drive, and an Internet access/IP address. From using your PC as a bot that the criminal can control, to your hard drive where they can store pirated files or even child pornography, to an IP that hasn’t been blacklisted.

If you’ve ever thought that “no hacker wants anything on my PC”, look at your PC as an asset that can be used to the hacker’s advantage to gain financially over possibly you, or others. Ignorance is your enemy. Hopefully, if you are reading this for the first time, you will come back for more knowledge.

567,000 Private Photos From MySpace Hacked

Now I tell you this, I am no expert on MySpace. I don’t have a MySpace page. I don’t plan on getting a MySpace page. But you may have a MySpace page or your kids may have a MySpace page. And if you do, this story may have caught your attention. Not too long ago, 567,000 photos that were marked private on MySpace were accessed, copied, and now are available on a 17 gig torrent.

One of the things MySpace does to protect minors against pedophiles is to mark photos posted on their MySpace page private so only “friends” they have can access these photos. Adults who have MySpace pages also can mark photos either public or private. If they are marked private, it works the same way. Only people they have designated certain “friends” are able to access these private photos. Due to a vulnerability in the MySpace private photos, some 567,000 were extracted from the MySpace files. Now one might wonder how could MySpace not see hundreds of thousands of requests from one IP address isn’t seen. A 17 gig file is huge not to see.

Oh well. Supposedly this has been fixed. But the lesson should be this. If you ever post pictures that are supposedly private on the Internet, someday, someway, their may be a possible software vulnerability that allows someone to steal these pictures and they will live forever as a file that can be accessed. This is something I try and suggest. Never post anything that you wouldn’t mind being seen by everyone. I haven’t read any details, but I’m sure there are some nude pictures that have been posted and were assumed protected by being marked private. Well not so.

This is a good example of creating your own “need to know policy” where you don’t disclose anything about yourself online. Crooks are always looking for ways to steal information about you. If you have kids and they are on MySpace, you may want to warn them that if they had pictures marked private, there are thousands and thousands now that are public record. Some may be embarrassing, so warn them of the dangers of posting things on the Internet and don’t let people know too much about you. Protect your privacy by not disclosing anything without thoughtful consideration.

Take care and stay safe.