Cryptome Hit By Blackhole Exploit Kit

← Back to Stories (view on slashdot.org)

Cryptome Hit By Blackhole Exploit Kit

Posted by Unknown on Monday February 13, 2012 @11:48AM from the leaks-were-sleeping-around dept.

wiredmikey writes with an excerpt from Security Week:"Whistleblower site Cryptome has been hacked and infected by the Blackhole exploit kit. ... Cryptome co-founder John Young however told SecurityWeek that the Cryptome site is in the process of cleaning everything up, and that process should be finished by the end of the day. Founded in 1996, Cryptome publishes thousands of documents, including many related to national security, law enforcement and military. On Feb. 12, a reader advised the site that accessing a file had triggered a warning in their antivirus about the Blackhole exploit kit. ... Subsequent analysis found thousands of files on the site had been infected." Cryptome has certainly seen worse.

49 comments

Min score:

Reason:

Sort:

frosty day in hell when by Anonymous Coward · 2012-02-13 11:50 · Score: 1

security whistleblowers get hacked? neverrrrrrrrrrrrrrrrrrrrrr
The mysterious command by Anonymous Coward · 2012-02-13 11:53 · Score: 5, Informative

< SCRIPT src="/0002/afg/afg.php" >
I'm sure you all will sleep now that your burning curiosity was satisfied.
1. Re:The mysterious command by FriendlyLurker · 2012-02-13 20:21 · Score: 0, Troll
  
  Perhaps, just perhaps, Cryptome is infecting its visitors on purpose. You dont publish "thousands of documents, including many related to national security, law enforcement and military" without breaking a few eggs.
  Now that the common rabbles antivirus software has caught up, they are in the process of "cleaning up" the code so it wont happen again for a bit... watch this space.
Blackhole by Hatta · 2012-02-13 11:55 · Score: 3, Funny

Symantec says that Blackhole affects "various Windows platforms". Does Cryptome run on Windows?

--
Give me Classic Slashdot or give me death!
1. Re:Blackhole by jenic · 2012-02-13 12:16 · Score: 5, Informative
  Symantec says that Blackhole affects "various Windows platforms". Does Cryptome run on Windows?
  Whether or not cryptome runs in windows is not for me to say, however I do believe that cryptome was compromised and made to distribute the blackhole exploit. The following is found on TFA:
  
  Although I'm not a full fledged security researcher, I could shed some light on the script that you found on your server. The basic program flow goes like this when a client loads the script (in your case every time anyone visits one of your pages):
  
  the client IP address is compared against a list (net_match(...)) and if it falls within the range of the list it is in scope
  the client OS is determined and if it is a windows machine, it is in scope
  the client browser is determined and if it is a internet explorer (6.0 until 8.0) it is in scope
  if the client is in scope (i.e. all three of the previous are true), a file is created on your webserver (empty text file), the filename is the IP address of the client (probably for later retrieval)
  an iFrame is loaded in the browser of the client that will be impossible to see (width and height of 1 pixel) and that iframe points to the webpage of 'http://65.75.137.243/Home/index.php'
  After step 5 probably the browser is under attack and it will probably be a successful attack since the attackers knows the client to be a windows machine running an internet explorer browser, my guess would be that the client is now infected and part of a botnet to be used in other attacks. The IP address of the attacker is a webserver for the domain http://absolutely-free-meeting.com/ I'm not sure they have anything to do with this attack, probably they are a comprimised server like your webserver was compromised. The WHOIS information for this domain is registered by godady and I include their data and the registrants data below, it would be best to contact both so that they can clean up their server also. Conclusion:
  
  your webserver was compromised and a file was uploaded (the attacking script)
  the attacker was only interested in certain IP address (probably only a certain location)
  the clients that are infected are infected from another web server (no idea why since that attack script could have been put on your webserver also)
  PS: I tried to format that as best I could but slashdot was having none of it
2. Re:Blackhole by smudj · 2012-02-13 12:26 · Score: 2, Insightful
  
  Not sure if I would consider Symantec an "expert" in antivirus/anti-intrusion solutions any longer
3. Re:Blackhole by wbr1 · 2012-02-13 14:11 · Score: 0
  
  Sure they are. Just take the 'anti' part off and throw in scareware and RogueAV somewheres.
  
  --
  Silence is a state of mime.
4. Re:Blackhole by TheLink · 2012-02-13 18:28 · Score: 0
  
  The Symantec messages had the phrase "the attack was resulted from", is this considered OK for US English?
  
  Or they've outsourced that bit to somewhere else?
  --
  
  Too many replies beneath your current threshold
mysterious by Moblaster · 2012-02-13 11:56 · Score: 5, Funny

The secret command shows up as a dot (".") on my system.
This may not be enlightening to anyone, but it appears to be a small black hole.
1. Re:mysterious by steelfood · 2012-02-13 13:15 · Score: 2
  
  It's just evidence of the LHC working properly.
  
  --
  "If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
2. Re:mysterious by user+flynn · 2012-02-13 13:54 · Score: 5, Funny
  
  I clicked on the link and I couldn't see anything.
  Since then I've been slowly depressing my back button for what seems like years... to you.
  
  --
  In the distance you hear an ominous moo.
3. Re:mysterious by cold+fjord · 2012-02-13 16:09 · Score: 1
  
  You should have warned him not to lean too close to his screen or he could potentially be sucked in and crushed by the immense gravitational forces known in exist in certain configurations of punctuation
  Most Slashdotters are aware of the risk and that is why we so often see the more cautious ones omitting any meaningful punctuation
  With any luck the LHC will continue past its triumph in explaining the observed asymmetry between grammar and punctuation Nazis to helping us understand the Higgs and the asymmetry in matter and antimatter
  
  --
  much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
4. Re:mysterious by Genda · 2012-02-13 19:41 · Score: 1
  
  Also be careful, if the punctuation begins to glow, its reaching the end of its life and is about to evaporate in rather impressive gamma ray burst. The upside, is you can use the burst to sterilize food for long term storage or eliminate unpleasant neighbors.
5. Re:mysterious by Fjandr · 2012-02-13 20:42 · Score: 1
  
  even more careful slashdotters avoid the use of capital letters as the increase in mass from the extra black can cause the danger zone to increase in size a great deal
I've been infected too. by Anonymous Coward · 2012-02-13 11:58 · Score: 1

Almost every single sentence on my system ends in one of those ".". Including this one. Oh my god...
Don't worry by zAPPzAPP · 2012-02-13 11:58 · Score: 1

The blackhole may suck up all your whistleblow data, but no one can retrieve it from there.
1. Re:Don't worry by prehistoricman5 · 2012-02-13 12:12 · Score: 2, Interesting
  
  Not true. Black holes emit radiation in the form of Hawking Radiation. Because of the laws of physics, this radiation carries information about what went into the hole. Wikipedia's description is decent. http://en.wikipedia.org/wiki/Black_hole_information_paradox
  
  --
  Fuck Beta
2. Re:Don't worry by Anonymous Coward · 2012-02-13 15:54 · Score: 0
  
  Carries information in the same way that a cryptographic hash carries information about a stream of data. Black holes are the universe's hash functions!
"Blackhole WINDOWS Exploit Kit". by couchslug · 2012-02-13 12:11 · Score: 4, Informative

Yes, it matters.

--
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
1. Re:"Blackhole WINDOWS Exploit Kit". by Anonymous Coward · 2012-02-14 04:32 · Score: 0
  
  lexus Trike www.7gnomov.biz/category_6.html
Blackhole expliot kit?? by Tyrannosaur · 2012-02-13 12:23 · Score: 1

Doc this is heavy!
"Blackhole IE Exploit Kit" by sakdoctor · 2012-02-13 12:29 · Score: 4, Informative

This attacks specifically checks for, and excludes browsers which are not IE 6 to 8
1. Re:"Blackhole IE Exploit Kit" by Anonymous Coward · 2012-02-14 04:16 · Score: 0
  
  So it's an educational contribution for the betterment of the internet.
Hmm by koan · 2012-02-13 12:36 · Score: 2

The thing that bothers em most about this is that it was an end users anti-virus that detected it rather than software protecting the servers.

--
"If any question why we died, Tell them because our fathers lied."
1. Re:Hmm by AHuxley · 2012-02-13 14:04 · Score: 1
  
  Would some hosts not have "software protecting the servers" as a monthly or yearly upgrade in their basic to pro hosting options?
  
  --
  Domestic spying is now "Benign Information Gathering"
2. Re:Hmm by koan · 2012-02-13 16:06 · Score: 1
  
  Not sure what you're saying, in general I expect a server to have better protection than a client.
  
  --
  "If any question why we died, Tell them because our fathers lied."
3. Re:Hmm by AHuxley · 2012-02-13 17:00 · Score: 1
  
  Products like Sitelock might be offered per year per domain. http://www.sitelock.com/products.php
  See how the protection offered expands from a basic to premium services.
  Your host might offer https, static, databases, web 2.0 look/feel, unlimited data but extra security may be an 'extra'.
  
  --
  Domestic spying is now "Benign Information Gathering"
4. Re:Hmm by Lehk228 · 2012-02-14 00:50 · Score: 1
  
  It makes sense, you can't depend on a compromised system to detect itself
  
  --
  Snowden and Manning are heroes.
5. Re:Hmm by koan · 2012-02-14 12:20 · Score: 1
  
  That's another odd statement, I think the previous guy was trying to sell me something and you seem to be stating the obvious, I would not expect a compromised system to detect an issue (which is what I think you meant) the idea is to keep it from being compromised in the first place.
  
  --
  "If any question why we died, Tell them because our fathers lied."
6. Re:Hmm by Lehk228 · 2012-02-20 15:05 · Score: 1
  
  my point is, the software they were using either failed or was circumvented (or they were using none, unlikely)
  
  --
  Snowden and Manning are heroes.
Doesn't say so in TFA by Anonymous Coward · 2012-02-13 12:43 · Score: 2, Informative

But the infection started on the 8th of February.
Don't criticize, do it ! by Taco+Cowboy · 2012-02-13 12:46 · Score: 2, Insightful

If you can set up a public website so secure that no hacker can ever hack, why don't you set one up?
Instead of criticize, why don't you show the world that such a site is indeed possible?
Maybe you can even make a buck or two out of it

--
Muchas Gracias, Señor Edward Snowden !
1. Re:Don't criticize, do it ! by hweimer · 2012-02-13 15:51 · Score: 3, Informative
  
  If you can set up a public website so secure that no hacker can ever hack, why don't you set one up?
  Formally verified web servers have been around for a while.
  
  --
  OS Reviews: Free and Open Source Software
2. Re:Don't criticize, do it ! by Anonymous Coward · 2012-02-13 19:37 · Score: 4, Insightful
  
  "Formally verified web servers have been around for a while."
  This reminds me of Knuth's famous quote about some code he released:
  "Beware of bugs in the above code; I have only proved it correct, not tried it."
3. Re:Don't criticize, do it ! by Anonymous Coward · 2012-02-14 01:54 · Score: 1
  
  The fact you posed this, and even worse, it was moderated up, is just mind blowing. It wonderfully validates just how completely clueless and out of touch with reality so many people, such as yourself, really are.
  The only secure computer is one powered off, locked in a vault. And even then, its only as secure as the one who holds the key.
  Formally verified web servers are for CYA and provide only a minimal diference, if any, in the real world.
  We at slashdot are all dumber now for having read your post.
Re:"Blackhole BrowserPlugin Exploit Kit" by Anonymous Coward · 2012-02-13 13:17 · Score: 0

What it really looks for is outdated plugins. Lmgtfy'ing for things like spl0, spl1, spl2 all at once might luck out and show you a source. (Just be careful)
I analyzed a blackhole sent to a blackberry, and all the splX functions came back empty, but it still included the PluginCheck code.
Why would the operator care what browser you have? As long as your java runtime is pre 6u29 its all the same.
Revenge? by cold+fjord · 2012-02-13 16:12 · Score: 1

I have to wonder if this might be some sort of revenge attack due to the feud that has developed between Wikileaks and Cryptome?

--
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
1. Re:Revenge? by Xest · 2012-02-13 23:54 · Score: 1
  
  I don't think there's really a feud, just that Cryptome got pissy that this new little upstart Wikileaks came and stole all it's glory with leaks that made Cryptome's past leaks look pretty small fry.
  Really, Cryptome showed a bit of penis envy, but that was about it.
Re:How Nice by equex · 2012-02-13 23:32 · Score: 1

This is not a security site. Also, does any of these elite security websites have a 100% clean record?

--
Can I light a sig ?
Netcraft confirms it by Anonymous Coward · 2012-02-14 02:20 · Score: 0

That the OS is unknown
They must be using by Anonymous Coward · 2012-02-14 03:56 · Score: 0

McAfee, 'nuff said.
Re:With the white background in the end it looks e by Anonymous Coward · 2012-02-14 06:00 · Score: 0

Dude, I don't think the spambot cares what you or anyone else thinks.
Re:With the white background in the end it looks e by Shifty0x88 · 2012-02-15 18:04 · Score: 1

jesus, you would think with a post history like manysky211 has, that they would be removed from slashdot. reported as spam.
Analysis by Shifty0x88 · 2012-02-15 18:06 · Score: 1

Hey I just sent in my analysis of the PHP file they were asking about.

Anyone wanna take a second look?

I'm not that great of a PHP coder, but maybe a second, third, nth pair of eyes could help figure it all out.

BTW, they called me A6.
Cryptome Hit By Blackhole Exploit Kit by Anonymous Coward · 2012-02-15 19:30 · Score: 0

I wonder how supernam will feel about this.