Archive for January, 2010
Congressional Web Site Defacements Follow the State of the Union
Shortly after President Obama’s State of the Union address, constituents visiting the web sites of Congressional representatives like Charles Gonzalez (20th District of Texas), Spencer Bachus (Alabama’s 8th District), and Brian Baird (Washington’s 3rd District) were presented with a defacement message from the Red Eye Crew that as of 4:10 am EST remains up on their web sites. All of the sites affected are in the house.gov domain, but not every congressional site in the domain is defaced.
Umm…TechCrunch? Defacement Two in 24 Hours
Less than 24 hours from the last web site defacement, TechCrunch has been defaced again early this morning by the same cracker(s) responsible for yesterday’s attack. Whatever preventative measures were taken yesterday (WordPress upgrade, HTTP authentication for wp-admin) have not blocked the attacker’s access to modify TechCrunch’s content, as this morning the attacker left a profane message on top of the homepage for Michael Arrington as well as a few media outlets like Yahoo and the BBC. At this point TechCrunch should perhaps be ensuring that there is no uploaded shell on the server the site is hosted on.
TechCrunched – TechCrunch the Victim of a Defacement
TechCrunch, the popular blog founded by Michael Arrington in 2005 that profiles technology start ups with posts about their products and company news was the victim of a website defacement that has effectively taken the site down for a period of three hours at time of writing. The site initially went down a little after 1 AM EST with a message of “Hi” on the homepage, and for a while seesawed between coming back up, being newly defaced, and showing a “We’ll be back shortly” message.
Microsoft Posts Advanced Notification for Out of Band Patch
Microsoft has published the advanced notification for an unscheduled patch update release to occur tomorrow, outside of the normal patch Tuesday cycle. The update is for an Internet Explorer vulnerability reported to be a vector for the Aurora exploit which was used to attack Google and several other companies. The last time Microsoft released an [...]
The “Aurora” IE Exploit Used Against Google in Action
The big news hit earlier this week, the attack vector that allowed bad actors presumably from China into the networks of Google, Juniper, Adobe, and some 30 other firms was an Internet Explorer zero day, a use after free vulnerability on an invalid pointer reference affecting IE 6, 7, and 8 but only used in IE 6 according to Microsoft. Per Microsoft’s Advisory 979352: “In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution.. Earlier today this entry from yesterday at Wepawet (an online analysis engine for malware) was pointed out to H.D. Moore, and within hours Metasploit has an exploit of the vulnerability integrated. McAfee has confirmed that the exploit is out and the same one they saw during the investigation. The video below demonstrates how crackers gained access to the corporate networks of Google, et al. using this zero day attack.
Scareware Purveyors, Spammers, and Crooks Take Advantage of Haiti Earthquake
The worst earthquake in that area for 200 years, a magnitude 7.0, hit Haiti late Tuesday afternoon leaving areas like the capital of Port-au-Prince in ruins and many people in need. Predictably people are looking for ways to help and are using Google to search for relief agencies that can take donations to help the affected. Bad actors have taken advantage of this by engaging in search engine poisoning including taking over existing web sites, using techniques that boost search ranking, and installing malicious software using scareware tactics on user’s PC’s. They also set up fake donation web sites. Finally, they employ Spam e-mail, Twitter messages, and related electronic communication methods in order to direct users to these web sites.
Windows 7 SMB Kernel Crash Video
Back on November 11th, 2009 we confirmed Laurent Gaffié’s remote exploit for Windows that causes a kernel crash. The operating system actually freezes creating a denial of service when for example a user is tricked into clicking on a link to a malicious SMB share on a web page. The SMB client goes into an infinite loop when processing this malformed request according to Microsoft. The video below demonstrates this effect, having a user click a web site link and showing the crash.
Using Group Policy to Disable JavaScript in Adobe PDF Files
We have previously posted instructions for users to disable JavaScript, giving them the option to enable it only when necessary. However, if you have made the decision to make this change across your enterprise or to a specific user base, this manual process is not practical. Therefore, a Group Policy Object is best to handle the task at hand.
First Patch Tuesday of 2010
We begin a new year and arrive at the first patch Tuesday of the decade. The news and spread of malware related to Adobe Reader continues to gain momentum and the information security community believes that this year will produce more exploits using Reader. I will include both the Microsoft and Adobe updates in these [...]
Baidu.com the Latest Victim of Iranian CyberArmy
A group called the Iranian Cyber Army has, fresh off the heels of their DNS attack on Twitter last month, hijacked the domain of Chinese search engine Baidu.com. Baidu is one of the most popular web sites in the world, a NASDAQ 100 multimedia company headquartered in Beijing that serves up over 740 million web pages along with music and video. The company employs over 6,000 people, has a 77% market share for search in China, and has annual revenue of about $200mm. For about three hours they were an advertising platform for a hacktivist group supporting the fundamentalist Islamic regime in Iran.
Categories
- Access Control
- Administration
- Botnet
- Censorship
- Certification
- Content Filtering
- Cross Site Scripting
- Cyberwar
- Data Breach
- data leak prevention
- Disaster Recovery
- enumeration
- Forensics
- funny
- homeland security
- Incident Response
- Industry News
- Intrusion Detection
- Law
- Malware
- Networking
- Patch Management
- Phishing
- Physical Security
- Remote Exploit
- scareware
- Security
- Security Policy
- Social Networking
- SQL Injection
- Stay Safe Online
- Technology in Society
- Tools
- Uncategorized
- Vulnerability
- Web Site Defacement
- windows
Recent Comments