Slashdot Mirror
Malware Pulls an "Italian Job"
A number of readers sent us word about a malware attack that has been underway since Saturday that began with the compromise of more than 1,100 mostly Italian Web sites. Websense claims that more than 10,000 sites have been infected by now, 80% of them in Italy. There are indications that most of the Italian sites are resident at the same large Italian hosting provider. Trend Micro reports on the attack, which is launched from a malicious Iframe tag inserted into pages on compromised sites. For visitors to these sites, this begins a cascade of "drive-by" malware downloads if one of several targeted vulnerabilities is available and unpatched. The first page to which visitors are redirected by the Iframe hosts a recent version of Mpack attack software. Panda has a month-old report on Mpack (PDF) that provides copious detail about its nefarious ways.
This malware probably just affected a single DreamHost shared server, thus bringing down 10,000+ sites at once.
But this method of artificial number inflating is to be expected from an industry trying to promote their anti-malware, anti-virus, anti-spyware, anti-trojan, anti-anti-virus, anti-rootkit products. Anyone actually requiring these craplets to be installed on their dedicated servers have a much larger problem between the keyboard and the monitor to worry about.
Speaking of looking like a douche, it's "viruses". I'll say it again, "viruses". Not virii.
Yes, viri/virii is incorrect (for now), but when the vast majority of us don't RTFA (or can't, due to the
Insightful my ass...
:P
The day your favorite OS dominates the market, it'll be pwned, don't you worry. And I say this as 1) a Firefox fan, hoping that it never gets to be the majority browser for precisely that reason, and 2) a fan of all the OS's. I use Windows for my desktops, Linux for my servers, and Mac sometimes to play. They all have fans, and I don't feel the need to belittle any of them to make one of the others look better. It doesn't work that way.
Hope I don't get modded down - I'm not so much flaming as ANTI-trolling if you catch what I"m trying to say. heh.
A cheerful little bird is sitting here singing.
Disclaimer: I am neither a Windows fan nor an Mac hater. I use Windows *nix almost equally.
Everytime some vulnerability is found, someone shouts about not using Windows, especially these Apple lovers. Come on guys, can we stop this? These so called malwares target novice users, not Slashdot users. Tell me a single alternative your mom can use and I will take it. The so called alternatives are either too_expensive (suggest your mom to shell out 2K on Mac just_to_get_on_internet) or too_not_userfriendly. Why not stop beating the drum on Windows?
"The day your favorite OS dominates the market, it'll be pwned, don't you worry."
If market share is any indication to being pwned; then why isn't Apache attacked more that IIS? According to Netcraft Apache has 53.76% of the market compared to MS: 31.83%
And I say this as 1) a Firefox fan, hoping that it never gets to be the majority browser for precisely that reason, and
I personally only want FF have enough of the market; just enough to make companies follow the web standards: IE not catering to only one browser. Actually, the same applies to ODF; just enough to make companies not require a specific Office Suite.
"2) a fan of all the OS's. I use Windows for my desktops, Linux for my servers, and Mac sometimes to play."
Use what ever works for you.
As a sign of this, I just got a spam that insisted I purchase a lower mortgage, along with a photo of a horse head.
Table-ized A.I.
The summary and linked articles don't even say that. Only Panda's MPack report, a dozen pages in, starts to list the actual vulnerabilities targetted. Which are IE, WMP and one Opera bug. However, the malware is actually modular in which new vulnerabilities can be plugged in, so this isn't static, and they say new versions come out about once a month.
Nevertheless, unless the WMP vulnerability works on multiple browsers, it's just Windows IE (duh) and Opera. No mention of Linux, Mac or Firefox I saw.
Actually, the Latin word for "man" is Vir, not Virus.
Note that Trend Micro never uses the word "Microsoft". That's deceptive. How does Microsoft manage that? This attack depends entirely on vulnerabilities in Internet Explorer and Microsoft Media Player. It does try to attack Firefox and Opera browsers by sending them Windows Media files, but doesn't have a direct attack on either browser.
So:
But I agree with you, virii is both bad English and bad Latin.
If we speak of groups of virus types (that is, a species), there are different forms used depending on whether we're speaking of a family, genus, etc. (if you read the full wikipaedia article, and if you studied it in uni):
Now the individual virus is a virion, which probably has its own possible plurals, to make matters worse.
But viruses is the correct plural for English speakers, by convention, but I remember the virulogist (or virologist) speaking of viruses as viridae, since we usually distinguish them by their family, eg: herpes, pox, and so on.
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
What the parent poster talked about was the very low amount of Apache-targeting viruses and exploits compared to those targeting IIS. Apache is the most widespread server software, but IIS is the one that gets most viruses.
And most of the time this kind of vector is used as described in current article : as a way to get control on machine to distribute malware and/or be used in a botnet.
Whereas, what you speak about - defacement - is done in most of the case, by stupid script kiddies who just use some random tool to exploits bugs (either remote execution or SQL injections) found in common PHP script (forum engines, etc.), it is mostly server independent. Apache or IIS doesn't matter as long as poor script code is present with known vulnerability. Therefore, you're very likely to find that the defacement frequence follows closely the market share of the servers.
Most of the time, the script kiddie just put "I am teh 1337 r0xx0rs !" in the front page. You can't do much with a compromised script (you can't start a IRC server, put a zombie bot, a full mail server for spitting spam or use it as a starting point to infect other servers in the vicinity).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Defacements are usually done exploiting poor coded PHP applications, not exploiting Apache bugs, FWIK...
From the article:
"Apparently, most of these sites are hosted on one of the largest Web hoster/provider in Italy."
Why would I not be surprised if Tiscali's webservers were somehow to blame?...
Looks like Windows*. No really. Yes again.
/. is quite alarming. People don't
- bizness/
" 1) A Trojanised WMF File (Downloader)
2) ActiveX/OCX File (dropper)
The downloaded malware, when executed, installs
1) A rootkit "
Most of the world is in denial about the whole security issue surrounding
Windows. Even some of the postage on
*want* to know, that's why they don't post it.
[*] - http://blog.trendmicro.com/italian-job-vs-italian
boycott slashdot February 10th - 17th check out: altSlashdot.org
...I was hoping for a story about a malware attack that involved the use of Michael Caine and numerous Minis.
Support Right To Repair Legislation.