SPAM frauds, fakes, and other MALWARE deliveries - archive

Online stock trading risky

FYI...

Online stock trading is risky
- http://www.f-secure.com/weblog/archives/00001909.html
March 17, 2010 - "Buying and selling stock online is big business. It also carries it's own risks. And we don't mean the risk of doing bad investments; we mean loosing access to your trading account because your computer got infected by a keylogger. Take a case of Mr. Valery Maltsev from St. Petersburg. Maltsev runs an investment company called Broco Investments... Unfortunately (to him), Maltsev was yesterday charged by US Securities & Exchange commission. They claim that Maltsev's extraordinary gains in thinly traded NASDAQ and NYSE stocks were not a co-incidence. Apparently Maltsev used malware with keyloggers to gain access to other people's online trading accounts. With such accounts, he could buy stocks at inflated prices, and use his real account to sell the same stock, for instant gains. Quoting from the SEC Complaint:
On December 21,2009, at 13:37, BroCo bought shares of Ameriserv Financial, Inc (ASRV) at a price of $1.51 per share. Approximately one minute later, three accounts at Scottrade were illegally accessed and used to purchase shares of ASRV at prices ranging from $1.545 to $1.828 per share. While this was happening, BroCo sold shares of ASRV at prices ranging from $1.70 to $1.80 per share, finishing at 13:52. By trading shares of ASRV within minutes of unauthorized trading through the compromised accounts, Maltsev and BroCo grossed $141,500 in approximately fifteen minutes, realizing a net profit of $17,760 ..."

- http://www.theregister.co.uk/2010/03/16/pump_and_dump_hacking/
16 March 2010 - "... The scheme earned at least $255,532 from August to December at a cost of $603,000 to broker-dealers, which had to reimburse customers... The lawsuit seeks an order freezing the Genesis accounts and requiring Maltsev to repay the lost funds..."

:eek::mad:
 
Battery recharger software trojan - more...

FYI...

Battery recharger software trojan - more...
- http://www.theregister.co.uk/2010/03/18/energizer_battery_trojan_returns/
18 March 2010 - "... the file that spreads the infection was -still- being distributed Wednesday evening on a European site operated by the consumer-products company. According to this VirusTotal analysis*, UsbCharger_setup_V1_1_1.exe is flagged as malicious by 24 of the 42 leading anti-virus firms. To make sure it wasn't a false positive, The Register checked with anti-virus firms Immunet and Trend Micro, both of which said the infection is real. Contrary to the VirusTotal results, the threat is also flagged by Symantec's Norton AV app, Immunet added. Trend Micro Senior Threat Researcher Paul Ferguson said his company's AV product also protects against it by flagging a key dll file, rather than the executable file. Microsoft labels the trojan as Arurizer.A and warns that it installs a backdoor on user machines that allows attackers to upload, download, and delete files at will, install additional malware and carry out other nefarious deeds. Twelve days ago, Energizer pledged to mount an investigation into how such a gaffe could have happened. The company has yet to release the results of that probe... Sometimes, the low-tech - or no-tech - solution is the way to go."
* http://www.virustotal.com/analisis/...4a121a0776b16bef9a661156864b6eb1d7-1268871703
File UsbCharger_setup_V1_1_1.exe received on 2010.03.18 00:21:43 (UTC)
Result: 24/42 (57.14%)

:mad::mad:
 
Zeus trojan - SPAM warning

FYI...

Zeus trojan campaign Warning - SPAM
- http://www.us-cert.gov/current/#us_cert_warns_against_zeus
March 17, 2010 - "US-CERT is aware of public reports of malicious code circulating via spam email messages impersonating the Department of Homeland Security (DHS). The attacks arrive via unsolicited email messages that may contain subject lines related to DHS or other government activity. These messages may contain a link or attachment. If users click on this link or open the attachment, they may be infected with malicious code, including the Zeus Trojan..."

:mad::mad:
 
‘Bad’ ISPs - Naming and Shaming...

FYI...

Naming and Shaming ‘Bad’ ISPs
- http://www.krebsonsecurity.com/2010/03/naming-and-shaming-bad-isps/
March 19, 2010 - "Roughly two years ago, I began an investigation that sought to chart the baddest places on the Internet, the red light districts of the Web, if you will. What I found in the process was that many security experts, companies and private researchers also were gathering this intelligence, but that few were publishing it... Fast-forward to today, and we can see that there are a large number of organizations publishing data on the Internet’s top trouble spots... Brett Stone-Gross, a PhD candidate in UCSB’s Department of Computer Science, said he and two fellow researchers there sought to locate ISPs that exhibited a consistently bad reputation... “The networks you find in the FIRE rankings* are those that show persistent and long-lived malicious behavior,” Stone-Gross said... For instance, if you click this link** you will see the reputation history for ThePlanet.com..."

Top 20 Malicious Autonomous Systems...
* http://maliciousnetworks.org/index.php

** http://maliciousnetworks.org/chart.php?as=AS21844

- http://maliciousnetworks.org/chart.php?as=AS15169

:fear::fear:
 
Last edited:
FYI...

Twitter phishing attack...
- http://www.f-secure.com/weblog/archives/00001911.html
March 21, 2010 - "Today there's a phishing run underway in Twitter, using Direct Messages ("DMs"). These are private one-to-one Tweets inside Twitter... If you mistakenly give out your credentials, the attackers will start sending similar Direct Messages to your contacts, posing as you. The ultimate goal of the attackers is to gain access to a large amount of valid Twitter accounts, then use these accounts to post Tweets with URLs pointing to malicious websites which will take over users computers when clicked... The good news is that Twitter is already filtering these from being posted, although it's unclear if they are also removing already-delivered DMs. Also, the Twitter built-in link shorteners (twt.tl and bit.ly) already detect the URLs as malicious."

(Screenshots available at the URL above.)

:mad:
 
Last edited:
Malicious medical ads flood Inboxes...

FYI...

Malicious medical ads flood users’ Inboxes
- http://blog.trendmicro.com/malicious-medical-ads-flood-users’-inboxes/
Mar. 21, 2010 - "TrendLabs observed an increase in malicious medical advertisements spammed to users’ e-mail inboxes. Two of the samples our engineers obtained looked legitimate, even had professional-looking graphics... Another was just the normal, everyday, plain-text spam... The spammed messages enticed recipients to purchase the medicines the scammers were selling. These lured recipients with supposed huge discounts, ranging from 70–80% off of all products. The messages also sported links that when clicked redirected users to a spoofed online store that sold male organ-enhancing pills. More recently, a spam run that uses a new feature was discovered. Instead of asking recipients to click an embedded link or an image, it asked them to open the .JPG file attachment—an image of Viagra and Cialis—along with the line, “DO NOT CLICK, JUST ENTER (a particular URL) IN YOUR BROWSER.” The spammed messages also contained a series of salad words to avoid being filtered..."

(Screenshots available at the URL above.)

:fear::mad:
 
Facebook "Dislike button" likes Hotbar

FYI...

Facebook "Dislike button" likes Hotbar
- http://sunbeltblog.blogspot.com/2010/03/facebook-dislike-button-likes-hotbar.html
March 23, 2010 - "... It seems the tactic of offering up Firefox (but giving you something else entirely) is going to be around for a little while. Below is a site promoting a Firefox .xpi called “The Dislike Button”, designed to let you add an “I dislike this” note to Facebook posts... The domain is dislikes(dot)info. Note the “Get Firefox” button at the top... you’re given the option of downloading a setup file from Hotbar…not exactly the Firefox download you were expecting. Should the end-user install it thinking this will give them Firefox, they’re very much mistaken... What they actually get is the option to download Hotbar (and no Firefox), complete with a preticked ShopperReports checkbox... Additionally, there’s a text link further down the page asking you to “Get Firefox now” which also directs you to the Hotbar install... I think... I dislike this."

(Screenshots available at the URL above.)

:mad:
 
Skype toolbar Outlook SCAM

FYI...

Skype toolbar for Outlook SCAM
- http://securitylabs.websense.com/content/Alerts/3586.aspx
03.23.2010 - " Websense... has discovered a new wave of email attacks targeting the Skype Email Toolbar. Up to now, the amount of spam is not large, but we believe it will increase. The spam email message contains a file attachment named SkypeToolbarForOutlook.zip, which could easily deceive users but is in fact a backdoor trojan that has a very low AV detection*. The spam email copies the look and feel of the legitimate application from Skype..."
* http://www.virustotal.com/analisis/...56cf070331ab482d6372ad10a5a6d92751-1269327702
File SkypeToolbarForOutlook.exe received on 2010.03.23 07:01:42 (UTC)
Result: 6/42 (14.29%)
(Screenshots available at the Websense URL above.)

Skype SPIM (Instant Messaging SPAM)
- http://www.m86security.com/labs/i/Skype-SPIM-Instant-Messaging-Spam--,trace.1289~.asp
March 26, 2010 - With over 520 million users, Skype is the most popular VoIP (Voice over IP) application available today. It provides a great service, allowing families, friends and colleagues to connect to one another through voice and video chat across the globe. However, being so popular doesn’t come without a price. The price that is paid is in the form of Skype SPIM (Instant Message Spam). These messages are pushed out to a large percentage of Skype users on a regular basis. The SPIM messages can range from the common pharmaceutical product spam, to fake OEM software, investment scams, replica bags and watches, and adult dating site spam..."
(More detail and screenshots at the URL above.)

:mad:
 
Last edited:
ZBOT variants targeting European Banks

FYI...

ZBOT variants targeting European Banks
- http://blog.trendmicro.com/new-zbot-variants-targeting-european-banks/
March 23, 2010 - "... new ZBOT variant mainly targeting four European countries’ banking systems in Italy, England, Germany, and France. Trend Micro detects this variant as TROJ_ZBOT.BYP. It targets major consumer European Banks and financial institutions with high-profile clientele. The targeted companies include the major UniCredit Group Subsidiary Bank of Rome; U.K.-based Abbey National (more commonly known as Abbey); Hong Kong’s HSBC; Germany’s leading IT service provider in the cooperative financial system, the FIDUCIA Group; and one of France’s largest retail banks, Crédit Mutuel... The ZeuS toolkit enables cybercriminals to create and customize their own remote-controlled malware. The infected machine then becomes part of the criminal ZeuS botnet. ZBOT variants are information stealers specializing in robbing online banking information from victims and sending back the information to its command-and-control (C&C) server. At its most basic level, ZeuS has always been known for engaging in criminal activities, as it signals a new wave of online criminal business enterprises wherein different organizations can cooperate with one another to perpetrate outright online theft and fraud... The domains used by TROJ_ZBOT.BYP are both hosted on the same server, which is located in Serbia under a registered name. The IP address used and its registered name are both well-known for being part of FAKEAV-hosting domains and previous Canadian pharmacy spam campaigns..."
- http://threatinfo.trendmicro.com/vinfo/web_attacks/ZeuS_ZBOTandKneberConnection.html
"... Since 2007... Trend Micro has seen over 2,000 ZBOT detections and the numbers continue to rise..."

:mad:
 
Last edited:
Fake Apple App Store Malicious SPAM

FYI...

Fake Apple App Store Malicious SPAM
- http://securitylabs.websense.com/content/Alerts/3587.aspx
03.24.2010 - "Websense... has discovered that Apple's App Store has become the latest target for email attacks and spam. App Store is the service provided by Apple Inc. as a platform to purchase and download applications for iPhone®, iPod touch®, and iPad™. The attack comes in the form of a fake invoice email. With Apple's App Store being one of the most popular shopping platforms for multimedia, this kind of App Store invoice email is familiar to users and tends to be received frequently. As demonstrated here, cyber-criminals clearly jump at a chance to spread their spam using any available means. The content in this campaign resides on compromised Web sites and serves a combination of pharmaceutical spam along with exploits that are delivered in the background. Some of the messages serve only pharmaceutical spam and some combine spam with exploits. In the example below, clicking the link in the message redirects the user to a site with a single link labeled "visit". In the background, a known exploit pack called "Eleonore" is delivered to the user's machine. If the user clicks on the link, they are redirected to a "Canadian Pharmacy" Web site. In this particular attack instance the file dropped by the exploit pack has 29% detection rate*..."
* http://www.virustotal.com/analisis/...759003f739fe6649cb501496a884ad75ae-1269442230
File updates.exe received on 2010.03.24 14:50:30 (UTC)
Result: 12/41 (29.27%)

(Screenshots available at the Websense URL above.)

- http://blog.trendmicro.com/spammers-spoof-the-apple-store/
Mar. 25, 2010

:mad:
 
Last edited:
Pictures Ruse Used to SPAM Zeus/Zbot

FYI...

Pictures Ruse Used to SPAM Zeus/Zbot
- http://blog.trendmicro.com/spam-with-“pictures”-used-to-spread-zbot/
Mar. 24, 2010 - "... fresh wave of spammed messages that were used to spread another ZBOT variant of the infamous ZeuS botnet. These messages warned users that a “jerk” posted photos of them and contained a link to the said images... the spammed messages appear to be from innocent users that the recipients presumably knew. In addition, they were also signed or at least had the sender’s name at the end of the message. In the sample above, the sender’s name has been blurred to protect his/her identity. Combined, this may lead users to believe the message is legitimate. However, the link does not go to any legitimate social-networking or photo-hosting site. Users were instead prompted to download a “photo archive”. In addition, the download page also contains a malicious iframe, which leads to a website that previously hosted the Phoenix Exploit’s Kit, which was designed to take advantage of vulnerabilities in several popular applications like Adobe Flash, Internet Explorer (IE), Microsoft Office, and Mozilla Firefox..."

(Screenshots available at the URL above.)

- http://threatinfo.trendmicro.com/vinfo/articles/securityarticles.asp?xmlfile=030210-ZBOT.xml

- http://ddanchev.blogspot.com/2010/03/zeus-crimewareclient-side-exploits.html
March 24, 2010 - "... Updates will be posted as soon as new developments emerge. Consider going through the 'related posts', to catch up with the gang's activities for Q1, 2010..." ("Related posts" listed there)

:mad:
 
Last edited:
Swizzor - closer look...

FYI...

Closer look on Swizzor
- http://techblog.avira.com/2010/03/25/closer-look-on-swizzor/en/
March 25, 2010 - "We were analysing a recent version of Swizzor – an Adware which Avira detects as TR/Dldr.Swizzor.Gen – and after getting past the first encryption layers of the software, we stumbled over a few interesting strings in the malware. Quite obviously it installs a browser helper object (BHO, an Internet Explorer plug-in) which does some form of search hijacking. In case users get infected with Swizzor, they usually experience a -redirected- start page and a few pop-ups with advertisements for online poker or potency pills... Different Swizzor samples contain also different messages and links. Also, the malware is highly polymorphic. The Swizzor sample also contains a lengthy list of URLs which it blocks within the windows hosts file by redirecting them to localhost (127.0.0.1). Interestingly, those URLs all point to FakeAV or RogueAV... Also we see reports by users on the net which are victim of a Swizzor infection and didn’t download such “sponsored software” knowingly, but installed it for example with the “Windows Live Messenger” -add-on “Windows Live Plus! Messenger” where users can choose whether to install the “sponsor software” or not. Always keep an open eye whether the software you are going to install really is free or installs further stuff to your computer. You should find hints pointing to such add-ons in the EULA of the software."

:fear:
 
Fake lawsuit notification Attack

FYI...

Fake lawsuit notification Attack
- http://www.f-secure.com/weblog/archives/00001917.html
March 25, 2010 - "A few of days ago, we encountered an e-mail with a malicious RTF attachment. It was sent with a supposed lawsuit notification message. The e-mail didn't mention any company by name and took a shotgun, rather than targeted, approach... At this point, it appears that the attachment has been replaced by hyperlink pointing to the Marcus Law Center... It is difficult to determine whether or not the MLC site is compromised or just completely bogus. Their Our Firm page text borrows heavily from a New York lawyer's site, but that could just be a case of "honest" plagiarism. In any case, our browsing protection feature is now blocking the sub-directory hosting the malicious file as unsafe. The RTF file includes an embedded object that acts as a trojan dropper (Trojan-Dropper:W32/Agent.DIOY) and it drops a downloader (Trojan-Downloader:W32/Lapurd.D), which then attempts to connect to a server located in Southern China. The earlier attachment that we saw also attempted to connect to a server in China. Updated to add: SANS diary reports* that a number of .edu sites have also received a similar message. The domain, touchstoneadvisorsonline .com, is hosting the same RTF (.doc) file. .."
* http://isc.sans.org/diary.html?storyid=8497
Last Updated: 2010-03-25 13:30:36 UTC - "An email is being sent out warning the recipient of a "Copyright Lawsuit filed against you." We received a copy here and a number of .EDUs have reported it's receipt... Currently only a few AV solutions detect the initial document:
- http://www.virustotal.com/analisis/...1475f31526522716e827875801f92a0d87-1269486837 ..."
File r439875.doc-25mar10 received on 2010.03.25 03:13:57 (UTC)
Result: 7/42 (16.67%)

- http://isc.sans.org/diary.html?storyid=8506
Last Updated: 2010-03-26 14:19:15 UTC
> http://www.virustotal.com/analisis/...e4e39f29ca3e55ce00cbf497335a24c8ee-1269619641
File suit.exe received on 2010.03.26 16:07:21 (UTC)
Result: 21/42 (50.00%)

- http://www.us-cert.gov/current/#copyright_infringement_lawsuit_email_scam
March 26, 2010 - "... messages may contain malicious attachments or web links. If a user opens the attachment or follows the link, malicious code may be installed on the user's system..."

- http://ddanchev.blogspot.com/2010/03/copyright-lawsuit-filed-against-you.html
March 29, 2010

:mad:
 
Last edited:
Zeus wants to do your taxes

FYI...

Zeus wants to do your taxes
- http://isc.sans.org/diary.html?storyid=8503
Last Updated: 2010-03-25 20:44:53 UTC ...(Version: 2) - "... received reports of suspicious emails claiming to be from the IRS. It's a common scheme to get a user to click and run an executable. It looks like zeus/zbot to me...The email looks something like...
Subject: Underreported Income Notice
Taxpayer ID: <recipient>-00000198499136US
Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)
Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):
Internal Revenue Service
hxxp ://www.irs.gov.assewyx .co.uk/fraud.applications/application/statement.php?
The download in this particular link was "tax-statement.exe"..."

Child Tax Credit... Phishing Bait
- http://www.symantec.com/connect/blogs/child-tax-credit-new-phishing-bait
March 25, 2010

- http://www.us-cert.gov/current/#us_tax_season_phishing_scams
March 26, 2010 - "... tax season malware campaign. This malware campaign may be using malicious code commonly known as Zeus or Zbot..."

- http://www.irs.gov/privacy/article/0,,id=179820,00.html?portlet=5
"... The IRS does -not- initiate taxpayer communications through e-mail..."

:mad:
 
Last edited:
Fake update utilities...

FYI...

Fake update utilities...
- http://www.theregister.co.uk/2010/03/29/software_update_trojan/
29 March 2010 - "Miscreants have begun creating malware that overwrites software update applications from Adobe and others. Email malware that poses as security updates from trusted companies is a frequently used hacker ruse. Malware posing as update utilities, rather than individual updates, represents a new take on the ruse... recently detected Fakeupver trojan establishes a backdoor on compromised systems while camouflaging its presence by posing as an Adobe update utility. The malware camouflages itself by using the same icons and version number as the official package... "... malware is written in Visual Basic, faking such popular programs as Adobe, DeepFreeze, Java, Windows, etc. In addition, on being executed, they immediately turn on the following services: DHCP client, DNS client, Network share and open port to receive hacker’s commands..."

:mad:
 
Fake Facebook AV...

FYI...

Fake Facebook AV
- http://www.f-secure.com/weblog/archives/00001920.html
March 29, 2010 - "Facebook-specific antivirus application sound like a good idea? Maybe not. One of our analysts saw this particular application claiming to be an antivirus wreak havoc on his Friends list. Of course, there is no such thing... If a Friend looking through the photos then clicks on the app's (apparently randomly generated) link... you might end up with a series of albums... Once installed on one Friend's account, this application tags 20 Friend into a picture... You can find more information about this, including instructions on how to remove the tags on the photos, at FacebookInsider*.
Updated to add: Examples include Antivirus in Focebook and F'acebook antivirus.
Notice the -misspelling- of Facebook in both names. Facebook is already in the process removing and preventing such rogue apps."

(Screenshots available at the URL above.)

* http://thefacebookinsider.com/2010/03/warning-facebook-antivirus-will-virally-spam-your-friends/

:mad:
 
SPAM site registrations flee China for Russia

FYI...

SPAM site registrations flee China for Russia - A Little Sunshine
- http://www.krebsonsecurity.com/2010/03/spam-site-registrations-flee-china-for-russia/
March 31, 2010 - "... In early January 2010, and indeed in the months leading up to the new year, the percentage of domains advertised in spam registered in the .cn space dwarfed the number of .ru spam-related domains, according to figures gathered by the University of Alabama at Birmingham. But by mid-January, the number of .cn spam domains began to fall off dramatically, while the number of .ru spam domains increased markedly, UAB found (see graphic*). Gary Warner, director of research in computer forensics at UAB Birmingham, said a sizable share of spam-related new domain registrations continue to come through the .com space — which is served by hundreds of domain name registrars. But he said the biggest bulk registrations for spam domains routinely came out of .cn, particularly those associated with rogue online pharmacies. “The .com never had the volumes of abuse you’d see at one time in .cn, where you’d typically have one guy registering hundreds or thousands of spam domains every day,” Warner said. There is a decent chance that the spammers will move to another country-code registrar soon. Beginning April 1, Russia’s Coordination Center for domain registration will require individuals and businesses applying for a .ru address to provide a copy of a passport or legal registration papers. Warner said he’s looking forward to seeing a similar exodus from Russia in the weeks ahead. “I’m excited about the prospects of seeing the [number of] .ru spam domains going down just like we saw with China,” he said... ISC’s spam traps had identified more than 10,000 unique domain names being advertised in spam. More than 1,870 of those domains were tied to recently registered rogue pharmacies, and of those, 491 were registered in the .com space, while 18 were from .cn and 1,366 were at .ru Web sites..."
* http://www.krebsonsecurity.com/wp-content/uploads/2010/03/cnruspam.jpg

:fear::fear:
 
Korea: 31% of malware origins - March 2010

FYI...

Korea: 31% of malware origins - March 2010
- http://sunbeltblog.blogspot.com/2010/04/number-of-infected-computers-spikes-in.html
April 07, 2010 - Number of infected computers spikes in Korea - "Hong Kong-based security firm Network Box reported that Korea was the country of origin for 31.1 percent of the malware on the Internet in March*. In February the country only pumped out 8.9 percent, leading researchers to theorize that there has been a huge increase in infected machines there pushing out phishing spam. Network Box includes phishing in its calculations of monthly malware statistics. They also include North and South Korea as one country in their categories, but say the lack of public computers in the North means that South Korea is the country of origin for the bulk of the statistic. The US was second on the list at 9.34 percent..."
* http://www.infosecurity-us.com/view/8547/korea-reigns-as-king-of-malware-threats-/

- http://response.network-box.com/

:fear::mad:
 
Facebook SCAM again - fake Ikea page

FYI...

Facebook SCAM again - fake Ikea page...
- http://www.computerworld.com/s/arti..._victims_seeking_Ikea_gift_card?taxonomyId=17
April 9, 2010 - "... latest example of a new and pernicious trend on the social-networking site as scammers - usually disreputable online marketers trying to earn review by generating Web traffic - have flooded Facebook with these fake gift card pages over the past months. In late March, a similar $1,000 Ikea gift card scam took in more than 70,000 victims, and just last week another scam Facebook page offering a $500 Whole Foods gift certificate was widely reported. Friday's scam page had taken in more than 37,000 users by 11:30 a.m. Pacific Time, offering them a $1,000 gift certificate in exchange for promoting Ikea to their friends. At that time, the page was gaining new fans at the rate of about 5,000 per hour. The promotion, the page said, was only available for one day. To participate, users must become a fan of the fake Ikea page, hosted on Facebook, and then invite all their friends to become fans. They are then directed to an affiliate marketing page hosted by GiftDepotDirect .com, where they are asked personal information such as name, address, date of birth and home telephone number. After that step, the victim is told to sign up for two online marketing offers - these ones with legitimate Web sites such as Netflix and CreditReport .com - in order to claim the gift card. The promised cards in these scams never show up..."

:fear::mad:
 
Wordpress blogs hit by ‘Networkads.net’ hack

FYI...

Wordpress blogs hit by ‘Networkads.net’ hack
- http://krebsonsecurity.com/2010/04/hundreds-of-wordpress-blogs-hit-by-networkads-net-hack/
April 9, 2010 - "A large number of bloggers using Wordpress are reporting that their sites recently were hacked and are redirecting visitors to a page that tries to install malicious software. According to multiple postings on the Wordpress user forum and other blogs, the attack doesn’t modify or create files, but rather appears to inject a Web address — “networkads .net/grep” — directly into the target site’s database, so that any attempts to access the hacked site redirects the visitor to networkads .net. Worse yet, because of the way the attack is carried out, victim site owners are at least temporarily locked out of accessing their blogs from the Wordpress interface. It’s not clear yet whether the point of compromise is a Wordpress vulnerability (users of the latest, patched version appear to be most affected), a malicious Wordpress plugin, or if a common service provider may be the culprit. However, nearly every site owner affected so far reports that Network Solutions is their current Web hosting provider... A scan of the file delivered by that redirect shows rather poor detection by most anti-virus products: Virustotal.com found that only 7 out of 39 anti-virus products detected it as malicious*...
The following how-to-repair instructions appear to have worked for a number of Network Solutions customers hit by this attack.
- Log in to your site at networksolutions.com
- Using Network Solution’s MySQL admin console, browse to the wp_options table and change the value for “siteurl” to your blog’s URL . For example: “http://example.com/wordpress”.
- Edit wp_config.php to override value of SITEURL (this way even if the database value is altered, it gets overridden by the config value.
Still, that fix may only be temporary ..."
* http://www.virustotal.com/analisis/...ed7adcebb61d8ad1000797cab84b03e777-1270828595
File 8d2c18111ad5d4815c4b610c0fa30043e received on 2010.04.09 15:56:35 (UTC)
Result: 7/39 (17.95%)

- http://google.com/safebrowsing/diagnostic?site=networkads.net/
"Site is listed as suspicious - visiting this web site may harm your computer...
last time Google visited this site was on 2010-04-09, and the last time suspicious content was found on this site was on 2010-04-09... Malicious software includes 29 exploit(s), 4 trojan(s)..."

- http://blog.sucuri.net/2010/04/details-on-network-solutions-wordpress.html
April 10, 2010

Alert: WordPress Blog & Network Solutions
- http://blog.networksolutions.com/2010/alert-wordpress-blog-network-solutions/
Update: 04/10/2010

- http://blog.trendmicro.com/wordpress-blogs-suffer-mass-compromise/
Apr. 11, 2010

:mad::fear:
 
Last edited:
Back
Top