Slashdot Mirror
iOS Developer Site At Core of Facebook, Apple Watering Hole Attack
msm1267 writes "The missing link connecting the attacks against Apple, Facebook and possibly Twitter is a popular iOS mobile developers' forum called iphonedevsdk which was discovered hosting malware in an apparent watering hole attack that has likely snared victims at hundreds of organizations beyond the big three. It's not clear whether the site remains infected, but researcher Eric Romang dug into the situation and determined that the site was hosting malicious JavaScript that was redirecting visitors to another site, min.liveanalytics. That site had been hosting malware as of Jan. 15."
Where's your God now?
Flexible bare-metal recovery for Linux/UNIX
OS X is a tinker toy OS. Its "security" is laughable. Use a real OS you retarded, hipster fanbois.
The fix to patch the vulnerability and remove the malware if it's there is available today. Mac users should do a software update.
will be nothing but hate.
The site in question has been hosting malware on and off for over a year now. They were flagged at least half a dozen times by google over the past year for hosting malware. The site then went down for weeks while overhauling the entire forum software and then bam, this happens. Unfortunately some very good discussions happen on the site and I just can't quit using it.
What the heck is a "watering hole attack"?
File under 'M' for 'Manic ranting'
What's the full host name(s) of the infected sites so we can block it hosts files + dns entries?
This is a good reminder that with web-security you're only as secure as the weakest link. A new exploit pushed from a popular dev site on a trusted platform like Java is going to hit you hard and you can't avoid it directly. The real story here is how quickly / properly people responded, and how well defensive infastructure and policy stopped the intrusion. There's months and months of good security analytical reading right here. We can also compare company to company as it hit more than one.
Still mostly attack Windows. But Android and iOS phones are a juicy target, especally with people starting to use them as rich media devices. There's no prompt to allow anything, just click on the link and you're pwnd.
uh? what? /. hasn't been hacked? Or they just haven't admitted?!? Where am I? Where's my monkey?
Apple devs wouldn't know security if it bit them in the iPhone so this is less than surprising. Then you use a browser exploit that targets macs, which is (debatably) easier to make and tada. I'm going to take a wild guess that Facebook's devs aren't too bright either, based solely on their coding and design work aka the Facebook website.
Ah, the weakly supported claims that China is at an all-out "cyberwar" now become clearer. The Chinese army must have created the site min.liveanalytics.org. Then they deviously drew in visitors from a popular site, including some from major US corporations. For any machine that was vulnerable, China has thusly "hacked" the corporations owning those machines. Hackers get cred, the news media gets to scream that the sky is falling, and the US government gets to increase funding for the "war on cyberterror". It's win-win-win!
As to your next question, no I do not know the owner of min.liveanalytics.org to prove it is owned by the PLA. However I follow the same standards as the news media, security companies, and most slashdot posters; i.e., that it "seems reasonable" and "who can doubt that they are behind it." Who, indeed!
Curious to know how the iphone dev thinngy site got hacked btw...
But basically the issue comes down to this: you MUST be root (i.e. give the root password) to install Java on OS X (on Windows too btw) hence even if Java is *supposed* to be correctly sandboxed you simply cannot be sure. All that is needed is a tiny Java exploit and BOOM: full root access to OS X.
On Linux, contrarily to Windows or OS X, you do NOT need to be admin/root to install Java. However most people --totally and utterly stupidly-- do still install Java on Linux using apt-get or rpm. Frak no: use the .tar.gz. This is easy to do.
Now the other issue (and probably the most important one) is that people do not realize how gigantic of an attack vector the browser is, on any platform. You should settle for a safer way to browse: use a separate user account only for browsing (and of course without Java installed). Ideally use a throwaway VM (like a KVM VM) to surf.
I fully expect way more important Windows and way more important OS X attacks in the future and gigantic number of devs getting owned and owned and owned.
Meanwhile people surfing from VMs shall be quite safer.
There's an update to the first article - looks like almost the same attack (via the same JavaScript inclusion, using a different exploit of course) was active on Fedoraforum.org last July.
Of course news about a fake are Fake News.