Security News Collected by AWSODA-SYSTEMS: 2008-05-25

Here are the latest updates for security-news@awsoda.net

It is that month of the year when flowers are in full bloom and people celebrate them in festive events. And it seems that same eventful—but darker—tone can be used to describe the month of May for the security industry. Trend Micro has so far documented several mass compromises of Web sites around the world for this month. Yes, you read it right—the world over.

Here are the highlights of the notable Web site compromises we have seen in the past month:

May 2 - One Year Later, Italian Job Still Working Overtime

It's been a year since the infamous Italian Job attack of 2007. And in an apparent observance of its anniversary, a similar attack was seen compromising about 90 varied Italian Web sites, all hosted in Italy by a single hosting provider—the same one that hosted the thousands in last year's large-scale.

TrendLabs discovered two forms of this compromise: one via an injected obfuscated script that redirects to a certain malicious URL, and the other via a readable iFrame and the same obfuscated script.

May 7 - A Very Convoluted Chinese Gaming-Info-Stealing Campaign

Web sites numbering approximately 9,000 were compromised via SQL injection with embedded malicious JavaScript redirecting users to two major malicious URLs. Among these Web sites were legitimate medical, educational, government, and entertainment sites from around the world.

A survey of the site locations includes India, UK, Canada, France, and China. This observation suggests the attack as the work of an automated Chinese hacktool programmed to search through Web sites for vulnerabilities, creating the same .HTML file that has been used to launch various exploits.

May 10 - More of The Same: Another Half Million Web Sites Compromised

Meanwhile, a malicious script was injected into half a million Web sites believed to be either using poorly implemented or older exploitable versions of phpBB. This event was involved a ZLOB Trojan among others that changes an affected system's local DNS and Internet browser settings.

May 19 - Chinese Weekend Compromise

Also on the same date, Chinese-language Web sites were targeted in an attack that was meant specifically against China, Taiwan, Singapore, and Hong Kong. Google search results at the time of the attack showed 327,000 pages containing the malicious script tag.

May 19 - Yet More Weekend Compromises Reach Other Shores

Another string of Web site compromises was discovered the following week, involving at least four (4) Web sites of various affiliations and different countries. These were injected with a malicious JavaScript that redirects to two sites. Both eventually lead to their own series of redirections, and finally the download and execution of malware: a backdoor and Trojan, respectively.

May 21 - It's Not Over: Asian Sites Injected with Nasty Code

Two days later, hundreds of thousands of Web sites were again found compromised and inserted with malicious JavaScript code, some of which are sites from the APAC region. Hackers have apparently conducted another massive SQL injection attack. A Google search for the malicious URL turned up 197,000 results.

May 22 - Malicious Domains Found in Compromised Japanese Sites

The next day, several Web sites in Japan — including a popular music download site and a music company site — have been found injected with malicious code.

These are the hard facts, and these developments tell us that there could indeed be a trend that cyber criminals seem to favor this type of attack over other methods. For what it’s worth, our engineers also think that mass compromises are common (or at least not as uncommon as we think), it's just that they are either found soon enough, or they remain unnoticed and consequently unreported.

These documented compromises appear to be not distinct incidents unto themselves, but rather one big organized attack that just involved different domains. However, it is also very much possible that there are different groups using the same tool, or a big organized group outsourcing to small-time hackers. Until solid evidence is obtained, these scenarios are speculations as of the moment. We are keeping a close watch.

ShareThis

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Total Recall: The Month of Mass Compromises'

National Bank of Kuwait Phished

Banks all over the world are fast taking on the challenge (and opportunity) of bringing part of their operations online. Sadly, being spoofed in a phishing attack is one of the risks financial services companies have to continually address via user education. Early this week we were able to catch a phishing attempt targeted at account holders of the National Bank of Kuwait (NBK).

The phishing URL pretends to be a legitimate National Bank of Kuwait official login page:

After entering the required information the next phishing page will ask for your ATM Pin and Civil ID. This may attempt to confuse the users into believing that the phishing Web site is directly related to the legitimate site:

Here is a screenshot of the legitimate National Bank of Kuwait login page (a brilliant copy, yes?):

Note that doing a WHOIS on the actual phishing URL reveals that the attempt seems to have originated from Chile. The attack is directed at users in the Middle East. Phishers typically commit border-crossing crimes to at least hold off immediate entrapment by the law. Trend Micro users need not worry as our URL filters already recognize and block this threat.

ShareThis