Slashdot Mirror

← Back to Stories (view on slashdot.org)

Network Solutions Sites Hacked Again

Posted by Soulskill on from the at-least-they're-consistent dept.

CWmike writes "A week after Web hosting company Network Solutions dealt with a large-scale infection of WordPress-driven blogs, the company acknowledged that other sites it hosts have been compromised. 'We have received reports that Network Solutions customers are seeing malicious code added to their websites and we are really sorry for this experience,' said spokesman Shashi Bellamkonda in a blog post. 'At this time, since anything we say in public may help the perpetrators, we are unable to provide details.' Securi Security Labs said on Sunday that at least 50 sites hosted by Networks Solutions had been hacked, and that malicious JavaScript injected into those sites was redirecting unsuspecting users to a Ukrainian attack server. The same server was involved in the earlier attacks against Network Solutions-hosted blogs. According to the StopMalvertising blog, the attacks planted a rogue IFRAME on the hacked sites to shunt users to the attack server. That server then launches multiple exploits, including an attack kit of ActiveX exploits and three more leveraging Adobe Reader vulnerabilities, against visiting PCs. Several browsers, including IE8, Chrome and Firefox, display warnings when users are redirected to the attack site."

5 of 68 comments (clear)

  1. Re:Broswers Display Warnings by Anonymous Coward · · Score: 1, Informative
    What part of

    including an attack kit of ActiveX exploits

    did you misunderstand?

  2. Re:happened to a friend's blog by Anonymous Coward · · Score: 1, Informative

    Yes.

  3. This is no joke.. all of my NetSol sites hacked by OctavianMH · · Score: 4, Informative

    One client of mine had about 15 sites hosted on NetSol, every one was hacked.

    The bot is:
    1) Checking for any "index." file (index_ files were unaffected) with any extention
    2) Searching for a tag
    3) Inserting a pile of obfuscated javascript after the tag.

    If you have any clients on netsol, DO check them, NOW.

    @mbhnyc

    --
    "In the end, we all fall back on fiction." -- Lonely Planet
  4. Re:Broswers Display Warnings by 0123456 · · Score: 2, Informative

    Have fun: you don't need to click on anything to get owned by Flash malware served from an advertising site.

  5. Re:Those lying dogs by EXrider · · Score: 2, Informative

    Their admins must be completely incompetent. It's ridiculous that weeks later they can't figure out what's going on.

    We had an issue earlier this year with emails going to Network Solutions hosted domains being bounced because:

    "205.178.149.7 failed after I sent the message. Remote host said: 550 5.6.0 Lone CR or LF in body (see RFC2822 section 2.3)"

    Pretty self explanatory, except there WEREN'T any lone CRs or LFs in the message body! Some googling revealed that misconfigured Domino servers are prone to falsely reject certain "rich text" emails coming from Outlook with a legal disclaimer appended to them. The temporary workaround was to re-send the message in plaintext format since NS wasn't in any hurry to fix the problem. Our spam filtering provider argued with them for a while and it was eventually resolved, several freakin months later.

    --
    grep -iw skynet /etc/services