Slashdot Mirror
Network Solutions Sites Hacked Again
CWmike writes "A week after Web hosting company Network Solutions dealt with a large-scale infection of WordPress-driven blogs, the company acknowledged that other sites it hosts have been compromised. 'We have received reports that Network Solutions customers are seeing malicious code added to their websites and we are really sorry for this experience,' said spokesman Shashi Bellamkonda in a blog post. 'At this time, since anything we say in public may help the perpetrators, we are unable to provide details.' Securi Security Labs said on Sunday that at least 50 sites hosted by Networks Solutions had been hacked, and that malicious JavaScript injected into those sites was redirecting unsuspecting users to a Ukrainian attack server. The same server was involved in the earlier attacks against Network Solutions-hosted blogs. According to the StopMalvertising blog, the attacks planted a rogue IFRAME on the hacked sites to shunt users to the attack server. That server then launches multiple exploits, including an attack kit of ActiveX exploits and three more leveraging Adobe Reader vulnerabilities, against visiting PCs. Several browsers, including IE8, Chrome and Firefox, display warnings when users are redirected to the attack site."
And users will still click on everything they see.
---- Booth was a patriot ----
One of my clients' servers has had this spread around his box a few times by now; it's not a Network Solutions box though. Oddly, the NetSol VPS that I do work with hasn't (yet) experienced this. It's definitely automated and not all that smart as it infects PHP pages where it isn't appropriate, breaking code. It seems to search for the head section of a page and insert its obfuscated JavaScript; I'd guess it's a worm of some kind, possibly using PHP to look for more vulnerable hosts to infect.
Posting anon for obvious reasons.
Here at Network Solutions we have a great solution to clear up all that annoying web traffic you're seeing. It's called "Redirecting Attack Technology Service". Our RATS service will keep those pesky customers away without you having to do anything but sit back and watch ...
on the right side of the page.
Why did I never see offensive ads about BushCo other than
the ones I redirected users to?
Yours In Petrograd,
Kilgore Trout
I helped a friend restore their database and correct the initial file permission problem. It seems that by leaving the file with the database credentials world-readable, a script running on the same shared server as the site was able to get the DB host, user and password. The hacker then connected to the database and injected the iframe code in the "site url" settings entry.
Perhaps Word Press could put a big red div on the top of the site until users correct the file permissions to prevent novice users from leaving their config files unsecured.
As a side note, I'm still a bit uncertain if I actually fixed the file permission problem. If you are on a shared host and the DB config file is readable by the apache user (which is a requirement for Word Press to function), wouldn't any script running on the same server be able to read it?
I personally experienced this as well.
Network Solutions assured me this was my fault, even though I took every reasonable (and unreasonable) step required to harden my installation. I had my client migrate to MediaTemple. Problem solved.
Their admins must be completely incompetent. It's ridiculous that weeks later they can't figure out what's going on.
clifgriffin > blog
I love the javascript client/server application concept.
Deleted
It seems like it is a continual chain of iframe exploits. I'm not a web developer, can anyone more knowledgeable on the subject explain the amazing upsides to iframes that make them worth the extreme security issues they present?
Recently, another registrar's hosting service was compromised as well. Liberty Names of America, and the accompanying Prohostservers.com hosting packages, have been down for two weeks now without an ETA on when it'll be back up. Apparently, they were the target of a mass defacement a few weeks before this outage occurred.
No news here. Anyone purchasing services from Network Solutions simply hasn't done their homework. The rest of us left this disreputable vendor years ago.
But the server is connected to a Taiwan server, which is in turn connected a server on mainland China controlled by the government.
Seriously, NS charges more than twice the same amount for a personal domain per year than most other companies do (at least most major ones). I don't think any expects the mentality to be "I'm paying a premium for a perfect company", but some may say "I'm paying a premium for a company that's different or better than the other companies." So tell me, exactly, what are you paying a premium for?
Hosting services to use custom software that has NO means of modifying web content
that's visible or accessible to users of the web site or those who would infect it.
(Of course, they'd have to provide OTHER means for Developers to upload / chance
their web site contents, but ones that are much more secure than what got hit here.)
Perhaps the only way (other than with physical access to web hosting servers) to
add/modify content would be via a "call-back" system:
1. Developers lodges callback URL when setting-up a hosting service account
2. When a change to content is needed, Developer lodges a Change Request
3. Hosting service uses lodged callback URL to set up a VNP to Developer
4. Developer makes changes via VPN
5. Change process produces a Content Checksum (CC)
6. Developer saves CC & can later use it to check a site's content for hacks
Q.E.D.
One client of mine had about 15 sites hosted on NetSol, every one was hacked.
The bot is:
1) Checking for any "index." file (index_ files were unaffected) with any extention
2) Searching for a tag
3) Inserting a pile of obfuscated javascript after the tag.
If you have any clients on netsol, DO check them, NOW.
@mbhnyc
"In the end, we all fall back on fiction." -- Lonely Planet
I own a hosting company. This type of problem has been around for a long time now - the causes being either insecure software, compromised account logins or, in the worst case, incompetent server administration - oudated/insecure PHP configurations, usage of mod_php (shared general PHP user) over suPHP (all scripts run under your own username - so set chmod 400/600 and you're fine). The first two are a constant pain for all hosting companies, but the latter is firmly and solely the fault of the hosting company.
A client I dealt with 1-2 years ago is still on NetSol. I told him to switch over hosting and registrar companies, but he thought I was out to nickel and dime him (I offered him a 15$/month hosting plan...). Poor sob, all his sites are now down.
Wasn't there a similar case of hacking at NetSol a year or two ago.
Can anyone find any references ?
In the meantime, people still surf with full Javascript on, with all forms of active content execution open in their browsers -- congratulations for the "rich web experience". You get what you pray for.
I always cringe when I see some stupid web designers using a Javascript snippet where a simple link would do.
Here's a plea to web designers: make your sites usable _without any active content_. Add active content for the shiny effects -- for whoever cares. I don't.
I used to be a sysadmin for a hosting company, and we had these problems very much all the time. It's part of the job. When you provide a customer with web space, it's up to them to verify that the code they put ther is secure. Fortunately these attacks only affect a particular customer's site, and almost never compromises other sites on the server.
Why. Does. Network Solutions. Host. A. Blog.
Sorry, the mind just boggles. If you are the overactive twentyfive year working for Network Solutions and you want to host a blog and you're reading this - go do it somewhere else !
Religion is what happens when nature strikes and groupthink goes wrong.
20 minutes on hold with the helpless desk so far. No pop or smtp flowing through.
If this were easy, they wouldn't need us to do it!
Hmm, Security on Webhosting is a difficult thing.
Here is a list of Swiss Webhosting Companies.
They hava good security there.