Cryptome Hit By Blackhole Exploit Kit 49
wiredmikey writes with an excerpt from Security Week:"Whistleblower site Cryptome has been hacked and infected by the Blackhole exploit kit. ... Cryptome co-founder John Young however told SecurityWeek that the Cryptome site is in the process of cleaning everything up, and that process should be finished by the end of the day. Founded in 1996, Cryptome publishes thousands of documents, including many related to national security, law enforcement and military. On Feb. 12, a reader advised the site that accessing a file had triggered a warning in their antivirus about the Blackhole exploit kit. ... Subsequent analysis found thousands of files on the site had been infected."
Cryptome has certainly seen worse.
The mysterious command (Score:5, Informative)
< SCRIPT src="/0002/afg/afg.php" >
I'm sure you all will sleep now that your burning curiosity was satisfied.
"Blackhole WINDOWS Exploit Kit". (Score:5, Informative)
Yes, it matters.
Re:Blackhole (Score:5, Informative)
Symantec says that Blackhole affects "various Windows platforms". Does Cryptome run on Windows?
Whether or not cryptome runs in windows is not for me to say, however I do believe that cryptome was compromised and made to distribute the blackhole exploit. The following is found on TFA:
Although I'm not a full fledged security researcher, I could shed some light on the script that you found on your server. The basic program flow goes like this when a client loads the script (in your case every time anyone visits one of your pages):
After step 5 probably the browser is under attack and it will probably be a successful attack since the attackers knows the client to be a windows machine running an internet explorer browser, my guess would be that the client is now infected and part of a botnet to be used in other attacks. The IP address of the attacker is a webserver for the domain http://absolutely-free-meeting.com/ [absolutely...eeting.com] I'm not sure they have anything to do with this attack, probably they are a comprimised server like your webserver was compromised. The WHOIS information for this domain is registered by godady and I include their data and the registrants data below, it would be best to contact both so that they can clean up their server also. Conclusion:
PS: I tried to format that as best I could but slashdot was having none of it
"Blackhole IE Exploit Kit" (Score:5, Informative)
This attacks specifically checks for, and excludes browsers which are not IE 6 to 8
Doesn't say so in TFA (Score:2, Informative)
But the infection started on the 8th of February.
Re:Don't criticize, do it ! (Score:4, Informative)
If you can set up a public website so secure that no hacker can ever hack, why don't you set one up?
Formally verified web servers [nist.gov] have been around for a while.