Slashdot Mirror
iOS Developer Site At Core of Facebook, Apple Watering Hole Attack
msm1267 writes "The missing link connecting the attacks against Apple, Facebook and possibly Twitter is a popular iOS mobile developers' forum called iphonedevsdk which was discovered hosting malware in an apparent watering hole attack that has likely snared victims at hundreds of organizations beyond the big three. It's not clear whether the site remains infected, but researcher Eric Romang dug into the situation and determined that the site was hosting malicious JavaScript that was redirecting visitors to another site, min.liveanalytics. That site had been hosting malware as of Jan. 15."
Where's your God now?
Flexible bare-metal recovery for Linux/UNIX
The fix to patch the vulnerability and remove the malware if it's there is available today. Mac users should do a software update.
will be nothing but hate.
The site in question has been hosting malware on and off for over a year now. They were flagged at least half a dozen times by google over the past year for hosting malware. The site then went down for weeks while overhauling the entire forum software and then bam, this happens. Unfortunately some very good discussions happen on the site and I just can't quit using it.
What the heck is a "watering hole attack"?
File under 'M' for 'Manic ranting'
This is a good reminder that with web-security you're only as secure as the weakest link. A new exploit pushed from a popular dev site on a trusted platform like Java is going to hit you hard and you can't avoid it directly. The real story here is how quickly / properly people responded, and how well defensive infastructure and policy stopped the intrusion. There's months and months of good security analytical reading right here. We can also compare company to company as it hit more than one.
If you block *.com you should get a lot of it.
That was deeply hurtful and insulting. Why do you hate Tinker Toys so much?
Since the exploit was in Oracle Java I would blame Java, not the operating system which dutifully let the program run. What do you suggest that Apple should do to tidy up the security in OS X? Make it run only Apple approved binaries?
Not for the last two years. They passed it back to Oracle after Oracle bought Sun.
There are two types of people in the world: Those who crave closure
Of course this does not apply to Windows where hacks via flash, java, quicktime, etc are definitely the fault of the Windows OS, probably Bill Gates in particular, as he's the devil. That's always been the consensus on slashdot.
Since the exploit was in Oracle Java I would blame Java, not the operating system which dutifully let the program run.
Well that counts out just about every Windows exploit from being Microsoft's fault then, after all Windows was just dutifully letting the program run. Do you know nothing about security? If you can exploit a user level application to compromise the system then it is the system's fault.
Not exactly.
They stopped supporting future versions of Java - namely, Java 7. They still support Java 6.
In theory, by now, Java 6 support should have been dropped and Java 6 should no longer be updated at all. However, due to problems with Java 7, and compatibility issues between Apple Java and Oracle Java on Mac OS X, Java 6 lives on and is still being updated.
The Apple update to Java 6 was delivered through Software Update by Apple as an OS update. Java 6 is still done by Apple. At some point, Apple will drop support for Java entirely and the only way to run Java on Mac OS X will be to install it from Oracle.
In fact, this should have happened already. But it hasn't, yet. The next version of Mac OS X will presumably drop support for Apple's Java entirely, but as of today, it still lives on, and patches for it still come from Apple.
You are in a maze of twisty little relative jumps, all alike.
Ah, the weakly supported claims that China is at an all-out "cyberwar" now become clearer. The Chinese army must have created the site min.liveanalytics.org. Then they deviously drew in visitors from a popular site, including some from major US corporations. For any machine that was vulnerable, China has thusly "hacked" the corporations owning those machines. Hackers get cred, the news media gets to scream that the sky is falling, and the US government gets to increase funding for the "war on cyberterror". It's win-win-win!
As to your next question, no I do not know the owner of min.liveanalytics.org to prove it is owned by the PLA. However I follow the same standards as the news media, security companies, and most slashdot posters; i.e., that it "seems reasonable" and "who can doubt that they are behind it." Who, indeed!
Yet the security hole in question was related to Oracle Java, not Apple Java.
Since the exploit was in Oracle Java I would blame Java, not the operating system which dutifully let the program run.
Well that counts out just about every Windows exploit from being Microsoft's fault then, after all Windows was just dutifully letting the program run. Do you know nothing about security? If you can exploit a user level application to compromise the system then it is the system's fault.
Not quite - it all depends where the vulnerable code is. If it's in java.dll, the fault is Oracle's. If it's in, say, user32.dll, then the fault can definitely be blamed on Microsoft.
No colour or religion ever stopped the bullet from a gun
There's an update to the first article - looks like almost the same attack (via the same JavaScript inclusion, using a different exploit of course) was active on Fedoraforum.org last July.
Of course news about a fake are Fake News.