Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
Security The Internet News

Cryptome Hit By Blackhole Exploit Kit 49

wiredmikey writes with an excerpt from Security Week:"Whistleblower site Cryptome has been hacked and infected by the Blackhole exploit kit. ... Cryptome co-founder John Young however told SecurityWeek that the Cryptome site is in the process of cleaning everything up, and that process should be finished by the end of the day. Founded in 1996, Cryptome publishes thousands of documents, including many related to national security, law enforcement and military. On Feb. 12, a reader advised the site that accessing a file had triggered a warning in their antivirus about the Blackhole exploit kit. ... Subsequent analysis found thousands of files on the site had been infected." Cryptome has certainly seen worse.
This discussion has been archived. No new comments can be posted.

Cryptome Hit By Blackhole Exploit Kit

Comments Filter:
  • by Anonymous Coward

    security whistleblowers get hacked? neverrrrrrrrrrrrrrrrrrrrrr

    • If you can set up a public website so secure that no hacker can ever hack, why don't you set one up?

      Instead of criticize, why don't you show the world that such a site is indeed possible?

      Maybe you can even make a buck or two out of it

      • by hweimer ( 709734 ) on Monday February 13, 2012 @11:51PM (#39028641) Homepage

        If you can set up a public website so secure that no hacker can ever hack, why don't you set one up?

        Formally verified web servers [] have been around for a while.

        • by Anonymous Coward on Tuesday February 14, 2012 @03:37AM (#39029913)

          "Formally verified web servers have been around for a while."

          This reminds me of Knuth's famous quote about some code he released:

          "Beware of bugs in the above code; I have only proved it correct, not tried it."

        • by Anonymous Coward

          The fact you posed this, and even worse, it was moderated up, is just mind blowing. It wonderfully validates just how completely clueless and out of touch with reality so many people, such as yourself, really are.

          The only secure computer is one powered off, locked in a vault. And even then, its only as secure as the one who holds the key.

          Formally verified web servers are for CYA and provide only a minimal diference, if any, in the real world.

          We at slashdot are all dumber now for having read your post.

  • by Anonymous Coward on Monday February 13, 2012 @07:53PM (#39026755)

    < SCRIPT src="/0002/afg/afg.php" >

    I'm sure you all will sleep now that your burning curiosity was satisfied.

    • Re: (Score:1, Troll)

      Perhaps, just perhaps, Cryptome is infecting its visitors on purpose. You dont publish "thousands of documents, including many related to national security, law enforcement and military" without breaking a few eggs.

      Now that the common rabbles antivirus software has caught up, they are in the process of "cleaning up" the code so it wont happen again for a bit... watch this space.

  • Blackhole (Score:4, Funny)

    by Hatta ( 162192 ) on Monday February 13, 2012 @07:55PM (#39026765) Journal

    Symantec says that Blackhole affects "various Windows platforms". Does Cryptome run on Windows?

    • Re:Blackhole (Score:5, Informative)

      by jenic ( 1231704 ) on Monday February 13, 2012 @08:16PM (#39026953)

      Symantec says that Blackhole affects "various Windows platforms". Does Cryptome run on Windows?

      Whether or not cryptome runs in windows is not for me to say, however I do believe that cryptome was compromised and made to distribute the blackhole exploit. The following is found on TFA:

      Although I'm not a full fledged security researcher, I could shed some light on the script that you found on your server. The basic program flow goes like this when a client loads the script (in your case every time anyone visits one of your pages):

      • the client IP address is compared against a list (net_match(...)) and if it falls within the range of the list it is in scope
      • the client OS is determined and if it is a windows machine, it is in scope
      • the client browser is determined and if it is a internet explorer (6.0 until 8.0) it is in scope
      • if the client is in scope (i.e. all three of the previous are true), a file is created on your webserver (empty text file), the filename is the IP address of the client (probably for later retrieval)
      • an iFrame is loaded in the browser of the client that will be impossible to see (width and height of 1 pixel) and that iframe points to the webpage of ''

      After step 5 probably the browser is under attack and it will probably be a successful attack since the attackers knows the client to be a windows machine running an internet explorer browser, my guess would be that the client is now infected and part of a botnet to be used in other attacks. The IP address of the attacker is a webserver for the domain [] I'm not sure they have anything to do with this attack, probably they are a comprimised server like your webserver was compromised. The WHOIS information for this domain is registered by godady and I include their data and the registrants data below, it would be best to contact both so that they can clean up their server also. Conclusion:

      • your webserver was compromised and a file was uploaded (the attacking script)
      • the attacker was only interested in certain IP address (probably only a certain location)
      • the clients that are infected are infected from another web server (no idea why since that attack script could have been put on your webserver also)

      PS: I tried to format that as best I could but slashdot was having none of it

    • Re: (Score:2, Insightful)

      by smudj ( 1983234 )
      Not sure if I would consider Symantec an "expert" in antivirus/anti-intrusion solutions any longer
      • by wbr1 ( 2538558 )
        Sure they are. Just take the 'anti' part off and throw in scareware and RogueAV somewheres.
      • by TheLink ( 130905 )
        The Symantec messages had the phrase "the attack was resulted from", is this considered OK for US English?

        Or they've outsourced that bit to somewhere else?
  • mysterious (Score:5, Funny)

    by Moblaster ( 521614 ) on Monday February 13, 2012 @07:56PM (#39026775)

    The secret command shows up as a dot (".") on my system.

    This may not be enlightening to anyone, but it appears to be a small black hole.

    • It's just evidence of the LHC working properly.

      • You should have warned him not to lean too close to his screen or he could potentially be sucked in and crushed by the immense gravitational forces known in exist in certain configurations of punctuation

        Most Slashdotters are aware of the risk and that is why we so often see the more cautious ones omitting any meaningful punctuation

        With any luck the LHC will continue past its triumph in explaining the observed asymmetry between grammar and punctuation Nazis to helping us understand the Higgs and the asymmetr

        • by Genda ( 560240 )

          Also be careful, if the punctuation begins to glow, its reaching the end of its life and is about to evaporate in rather impressive gamma ray burst. The upside, is you can use the burst to sterilize food for long term storage or eliminate unpleasant neighbors.

        • by Fjandr ( 66656 )

          even more careful slashdotters avoid the use of capital letters as the increase in mass from the extra black can cause the danger zone to increase in size a great deal

    • by user flynn ( 236683 ) on Monday February 13, 2012 @09:54PM (#39027833)

      I clicked on the link and I couldn't see anything.

          Since then I've been slowly depressing my back button for what seems like years... to you.

  • by Anonymous Coward

    Almost every single sentence on my system ends in one of those ".". Including this one. Oh my god...

  • The blackhole may suck up all your whistleblow data, but no one can retrieve it from there.

  • by couchslug ( 175151 ) on Monday February 13, 2012 @08:11PM (#39026905)

    Yes, it matters.

  • Doc this is heavy!

  • by koan ( 80826 )

    The thing that bothers em most about this is that it was an end users anti-virus that detected it rather than software protecting the servers.

    • by AHuxley ( 892839 )
      Would some hosts not have "software protecting the servers" as a monthly or yearly upgrade in their basic to pro hosting options?
      • by koan ( 80826 )

        Not sure what you're saying, in general I expect a server to have better protection than a client.

        • by AHuxley ( 892839 )
          Products like Sitelock might be offered per year per domain. []
          See how the protection offered expands from a basic to premium services.
          Your host might offer https, static, databases, web 2.0 look/feel, unlimited data but extra security may be an 'extra'.
    • by Lehk228 ( 705449 )
      It makes sense, you can't depend on a compromised system to detect itself
      • by koan ( 80826 )

        That's another odd statement, I think the previous guy was trying to sell me something and you seem to be stating the obvious, I would not expect a compromised system to detect an issue (which is what I think you meant) the idea is to keep it from being compromised in the first place.

        • by Lehk228 ( 705449 )
          my point is, the software they were using either failed or was circumvented (or they were using none, unlikely)
  • by Anonymous Coward

    But the infection started on the 8th of February.

  • I have to wonder if this might be some sort of revenge attack due to the feud that has developed between Wikileaks and Cryptome?

    • by Xest ( 935314 )

      I don't think there's really a feud, just that Cryptome got pissy that this new little upstart Wikileaks came and stole all it's glory with leaks that made Cryptome's past leaks look pretty small fry.

      Really, Cryptome showed a bit of penis envy, but that was about it.

  • Hey I just sent in my analysis of the PHP file they were asking about.

    Anyone wanna take a second look?

    I'm not that great of a PHP coder, but maybe a second, third, nth pair of eyes could help figure it all out.

    BTW, they called me A6.

The road to ruin is always in good repair, and the travellers pay the expense of it. -- Josh Billings