Slashdot Mirror
Malware Pulls an "Italian Job"
A number of readers sent us word about a malware attack that has been underway since Saturday that began with the compromise of more than 1,100 mostly Italian Web sites. Websense claims that more than 10,000 sites have been infected by now, 80% of them in Italy. There are indications that most of the Italian sites are resident at the same large Italian hosting provider. Trend Micro reports on the attack, which is launched from a malicious Iframe tag inserted into pages on compromised sites. For visitors to these sites, this begins a cascade of "drive-by" malware downloads if one of several targeted vulnerabilities is available and unpatched. The first page to which visitors are redirected by the Iframe hosts a recent version of Mpack attack software. Panda has a month-old report on Mpack (PDF) that provides copious detail about its nefarious ways.
...that it's Windows machines that get 0wned.
Don't use Windows, don't get 0wned.
Guaranteed! This comment 100% Anthrax free!
That's all the insight I can come up with.
You are reading a sig. Cancel or allow?
This malware probably just affected a single DreamHost shared server, thus bringing down 10,000+ sites at once.
But this method of artificial number inflating is to be expected from an industry trying to promote their anti-malware, anti-virus, anti-spyware, anti-trojan, anti-anti-virus, anti-rootkit products. Anyone actually requiring these craplets to be installed on their dedicated servers have a much larger problem between the keyboard and the monitor to worry about.
...lies.
Beslides, I'm not technically savvy enough to use Linux and I dislike having to find an emulator for my favourite games, or run a screen-long line of code to start up my various crapplications. Sure, that might have changed since I last tried an OSOS, but my first experience wasn't too pleasant and I'm not anxious to repeat it. The operating system itself wasn't the problem. It was the forums. Too much "stfu MSn00b" and not enough actual help.
Insular sods...
THUD~*
A queso scan identified the machines used to compromise the servers as Mac Minis...
"I've got more toys than Teruhisa Kitahara."
Yes, viri/virii is incorrect (for now), but when the vast majority of us don't RTFA (or can't, due to the
-AC
You are the bane of my existence.
As a sign of this, I just got a spam that insisted I purchase a lower mortgage, along with a photo of a horse head.
Table-ized A.I.
It may be commonly used, but virii is stupid. Where did it come from? People trying to look knowledgeable about latin? Then viri makes sense; you know, because it's the plural of the actual latin word "virus" (which means 'man,' not virus or bug or anything even closely related). VIRUSES. IT'S NOT A DAMN LATIN WORD, PEOPLE.
Self Preservation Society...
"You're only supposed to blow the bloody doors off!"
Actually, the Latin word for "man" is Vir, not Virus.
Note that Trend Micro never uses the word "Microsoft". That's deceptive. How does Microsoft manage that? This attack depends entirely on vulnerabilities in Internet Explorer and Microsoft Media Player. It does try to attack Firefox and Opera browsers by sending them Windows Media files, but doesn't have a direct attack on either browser.
So:
But I agree with you, virii is both bad English and bad Latin.
Virus is a latin word (originally just meaning slime or ooze, but I've seen latin-english dictionaries list it as virus-virus.) Viri does mean men (virus does not mean man) but it also is the correct plural of virus.
Frosty piss posts are worthless, GNAA posts are worthless and hurtful, but they are the least of this site's neuroses.
THe fact that the language is evolving doesn't make any common distortion of the language right. Virii was not even right in Latin, so what would be the reason to create an irregular declination of a word without any reason other than trying to look cool?
If we speak of groups of virus types (that is, a species), there are different forms used depending on whether we're speaking of a family, genus, etc. (if you read the full wikipaedia article, and if you studied it in uni):
Now the individual virus is a virion, which probably has its own possible plurals, to make matters worse.
But viruses is the correct plural for English speakers, by convention, but I remember the virulogist (or virologist) speaking of viruses as viridae, since we usually distinguish them by their family, eg: herpes, pox, and so on.
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
Not to mention, the "language is evolving" argument doesn't mean that just any invented word is ok to use. Language evolves over time by itself, not because we're telling it to evolve.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
From what I could read in the italian newsgroups, attack started june 16 with the iframe added on "home pages". One user reported that a template inside a DB was modified, but news can't be confirmed.
The hoster is "Aruba", a really big hoster in Italy, famous for their low prices. A couple of weeks ago another italian "Hosting Solutions" was hacked. It seems that both hoster are using cpanel as a client frontend.
In both cases hosters were really bad at handling the situation. They both blamed clients about using weak password or that the password were stealed from their PCs.... can't be for an event so big....
After 4 days from the start of the attack (and several weeks after the similar attack at hosting solutions), we have no informations about HOW they succeded hacking the servers ! And THIS IS BAD ! We don't know if we have to blame cpanel, ftp server, windows or a particular site that using a site feature (sql ? cgi ?) allowed privilege escalation....
Francesco
Roma, Italy
What web servers are vulnerable? Been looking around but can't see anywhere anything about the type of web server being infected.
What the parent poster talked about was the very low amount of Apache-targeting viruses and exploits compared to those targeting IIS. Apache is the most widespread server software, but IIS is the one that gets most viruses.
And most of the time this kind of vector is used as described in current article : as a way to get control on machine to distribute malware and/or be used in a botnet.
Whereas, what you speak about - defacement - is done in most of the case, by stupid script kiddies who just use some random tool to exploits bugs (either remote execution or SQL injections) found in common PHP script (forum engines, etc.), it is mostly server independent. Apache or IIS doesn't matter as long as poor script code is present with known vulnerability. Therefore, you're very likely to find that the defacement frequence follows closely the market share of the servers.
Most of the time, the script kiddie just put "I am teh 1337 r0xx0rs !" in the front page. You can't do much with a compromised script (you can't start a IRC server, put a zombie bot, a full mail server for spitting spam or use it as a starting point to infect other servers in the vicinity).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
From the article:
"Apparently, most of these sites are hosted on one of the largest Web hoster/provider in Italy."
Why would I not be surprised if Tiscali's webservers were somehow to blame?...
Quidnam Latine loqui modo coepi?
While the Panda Software report is probably legit, I'd advise everybody here against downloading and using *any* software and/or service from them. Panda Software has a history of spamming and is tied to the infamous cult of Scientology. More info here.
...mojo-rific Italian Job with Quincy Jones producing it, or the lame up-to-date any-excuse-to-sell-a-video-game version?
...I was hoping for a story about a malware attack that involved the use of Michael Caine and numerous Minis.
Support Right To Repair Legislation.
Not completely on-topic but hey, it does not warrant a full "ask slashdot" and I've been struggling with this for a couple of days now ...
...
I've been hit with win32.Perlovga.A on a secondary computer through an infected USB key. That machine had no anti-virus and autorun was at that time enabled (stupid). This particular crapware saves two EXE files (copy.exe and host.exe) and an autorun.inf that executes copy.exe to the root of each volume. When the infected USB key was plugged-in, it loaded the mallware.
I removed all instances of the mallware itself, all is clean and nice, except for:
There seems to be some rootkit left behind because if I extract those two EXE files from where I saved them, they don't show-up in the filesystem unless I boot in safe mode, although nothing gets loaded in memory at this point.
Rootkit Revealer does not show anything suspicious, and AutoRuns shows way too much information and nothing that strikes me as odd.
Anyone has more experience with this one? I will really like to understand what it had done
Cheers!
k
Getting the attention of hackers by being big doesn't make you more vulnerable than you already were. If it was as easy to exploit Mac and Linux as it is Windows, there'd be viruses galore for them too.
Most Microsoft "bugs" are in the core design. They can't really fix those, because they consider them features.
Even if they started over the employees that came up with Autorun, ActiveX, DirectShow... they'd just ruin everything again.
A company which survives by imitating some good ideas will have mostly bad ones.
Apparently, you've never seen The Matrix!
...so what would be the reason to create an irregular declination of a word without any reason other than trying to look cool? Game.Set.
Match.
"I've spent my whole life figuring out crazy ways to do things. It'll work." -- Montgomery Scott, "Relics"
Actually, it is a Latin word, meaning "slime". But since it is a collective noun, it probably does not have a plural, just as we rarely refer to "slimes". It is probably thiord declension, in which case the plural is virus, rather than first, which would give virii.
Consciousness is an illusion caused by an excess of self consciousness.
"Vir means man. Its plural is viri"
Thus, Agent Smith is proved correct.
Virus derives from the Latin word for "venom" and has the neutral gender. The Latin plural -i only applies to masculine nouns of the o-declination. The proper plural for virus, if you'd want to use the Latin form, would be vira (though afaik there is no documented usage of the pural form), all neutral gender nouns have an -a (nominative) plural.
And when you gaze long enough into the code, the code will also gaze into you.
It is not spelled troll it's truth.
as far as I can tell from the pdf in TFA, the server side exploit package is relying on PHP and MySQL... so to me it generally indicates a Linux based server... although that isn't an actual given.
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
If english can tolerate octopuses why not virii?
If it's 3rd declension, that would give vires, right?
You forgot 'Pwn3d!'
It is boring to always read the same logical fallacy here regarding the monocrop argument: most MS fans keep saying "if insert any non-MS browser here was the market leader, it would be pwned just like Windows".
This is wrong. It is a logical fallacy easily debunked. If such an assertion was true, this would mean that all OSes would be equal regarding security. Which is wrong (in bold, several times, get it!?).
These MS astro-turfer fanboys keep repeating this logical fallacy ad nauseam and we can't stand it anymore: no, all OSes are not equal regarding security.
For a start, I'd guesshazard that if OpenBSD was the main OS its security would prove better than that of, say, Windows 98.
If you disagree with that you are wrong.
All OSes are not equal when it comes to security.
Do you get it now? Note that I'm not saying that more market share for Linux would not mean more attacks but simply that the pathetic security track record of MS OSes is not a fatality. There are a great many poor decisions and poor programming practices responsible for the mess we're in now (I'm talking, for example, about these botnets of 100.000+ Windows machines).
So, please, MS fanboys, stop astroturfing using your favorite logical fallacy "it's because Windows has 95% market share".
It is not. All OSes are not equal when it comes to security and this is a fact. Get it now?
And note too that even if a user doing a "sudo apt-get install m4lw4r3" can still break havoc does not either make all OSes equal regarding security.
I refuse to concede that DOS, Plan 9, OpenBSD, Linux, Mac OS X, Windows 95, Windows 98, Windows 2000, Windows XP, Windows Vista, OS 2, etc. are all equal when it comes to security. I refuse to concede that for they are not equal regarding security. You cannot prove that they all offer the same protection: they don't. So the monocrop argument is a logical fallacy.
Anyone trying to spread such blatant disinformation is an MS fanboy astroturfer.
Any more scans?
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
But I agree with you, virii is both bad English and bad Latin.
Here, here! Whomever reads slashdot, their things like this that effect how your percieved. Its rediculous, to!
Parce mihi, "Spare me," everyone here remembers Latin grammar worse than I do.
vir, plural viri, masculine, 2nd declension, "man"
virus, 2nd declension neuter, "venom" or "toxicicity"
bacterium, 2nd declension neuter, plural bacteria
We don't have any surviving attestations to a plural of virus, or AFAIK, any -us 2nd declension neuter. The meaning is by nature a collective noun: you don't hear "Potassiums" very often, do you? Or is it Potassia? My own sense is that the neuter-plural-ends-in-a wins out over -us-ending-takes-i-for-plural. After all, it's unus nauta not una nauta: grammatical gender wins out over consistent form. Cicero and Vergil aren't around anymore to ask, so that is the best we can do.
And yes, virii, is just awful, delicto summo.
OK, I don't get it. So how exactly did this virus mess up the traffic lights in Rome?
Squirrel!
There was an explosion of Italian bank targeting phishing sites reported to http://phishtank.com/ which I remember contacting an admin friend to ask what the heck going on.
I wonder if it is related to this one.