Security Firm Discovers Secret Plan To Hack Numerous Websites and Forums (softpedia.com)

An anonymous reader writes: According to Softpedia, "Security researchers from SurfWatch Labs have shut down a secret plan to hack and infect hundreds or possibly thousands of forums and websites hosted on the infrastructure of Invision Power Services, makers of the IP.Board forum platform." The man behind this plan was a hacker known as AlphaLeon, maker of the Thanatos malware-as-a-service platform. AlphaLeon hacked IP.Board's customer hosting platform, and was planning to place an exploit kit that would infect the visitors to these websites with his Thanatos trojan, in order to grow his botnet. Some of the companies using IP.Board-hosted forums include Evernote, the NHL, the Warner Music Group, and Bethesda Softworks (Elder Scrolls, Fallout, Wolfenstein, Doom games).

Comments

Virus

[fluffernutter]

Sometimes Slashdot makes me feel infected.

Re:Virus

[wbr1]

It's called slow clap.

Re: Virus

[Anonymous Coward]

Don't forget the variant, Pecked by Birds.
That's the one that causes UID 666 to come shit up your thread.

Re:Virus

[Anonymous Coward]

Nobody here would know how to get the clap.

Re:Virus

[LifesABeach]

Does AlphaLeon have a white kitty cat also? It would make sense then.

Re: Virus

[Anonymous Coward]

Don't be silly. Knowing how is easy, knowing who is not.

Would we notice?

[Anonymous Coward]

and Bethesda Softworks (Elder Scrolls, Fallout, Wolfenstein, Doom games)

They're all a bunch of zombies anyway, why not make their machines one too?

Thanatos as a virus scanner?

[Anonymous Coward]

I noticed in one of the side stories the title "New Thanatos Trojan Can Delete Competing Malware From The Target". If you had a way to remove Thanatos afterward, wouldn't that be a great way to clean out the system? If there was a competing trojan to Thanatos that could do the same thing, I'd be interested to see the two fighting it out on a throw-away system just to see what happens.

Re:Thanatos as a virus scanner?

[FatdogHaiku]

I know just the place for it...
https://xkcd.com/350/

Re:Thanatos as a virus scanner?

[Anonymous Coward]

From what I've read, Thanatos is a banking malware, and by competing malware it deletes other banking trojans, not ANY malware. Otherwise it would be a 500 MB trojan, just like Kaspersky.

With no clear indicator of intent

[rmdingler]

I cannot tell if this is parody or... "Shut down a secret plan" ....no wait, I know which one it is.

Re:With no clear indicator of intent

[Anonymous Coward]

It's the new wave of computer security. Now these heroes aren't defending us from merely haxx0rin haxx0rz, these heroes are defeding us from seeeeeekrit haxx0rin haxxorz bent on wuuurld domainashun. Wif de haxx. Rilly. Also, anyone fancy a new imperial cloak? Cheap this week!

Re:With no clear indicator of intent

[Anonymous Coward]

I got no mod points, but that was funny to me :)

Re:With no clear indicator of intent

[gweihir]

Just like the FBI with "terrorists": If you do not have enough to spread fear and advance your agenda, create some!

Re:With no clear indicator of intent

[rmdingler]

Yes, it is true that the governors use the fear of any threat, preferentially foreign, no matter how remote it's actual threat of inflicting damage may be.

This isn't new to the FBI, or even the NKVD or the OSS... this is 1500's Machiavellian in nature.

Re:With no clear indicator of intent

[gweihir]

Indeed. A very old strategy, that is just as despicable today as it was throughout history. Machiavelli was probably just the first that described this well and who had his writing survive. Today, people could easily know better with all the access to information the average person has, but apparently the cave-man reflexes are stronger and so this obvious manipulation-technique keeps working.

IPB is still around?

[Anonymous Coward]

I stopped using it in 2003 when a drive-by worm kocked the board suddenly offline with everything gone.

infecting with malware?

[Gravis Zero]

seems a bit redundant, i mean, these people are already using PHP. ;)

Kernelmode.info

[Anonymous Coward]

malware RE junkies and newbs might enjoy this forum.

Microsoft Windows strikes again ..

[khz6955]

"to be attractive to its customers, Thanatos had to run on a very large number of infected hosts"

DOH!

"In the infosec community this structure is called a botnet"

Thank you slashdot for this razer sharp technical analysis of distributed botnets :)

Re:Microsoft Windows strikes again ..

[Anonymous Coward]

In this case no, it is Linux strikes again, the intended hosts were Linux based.

LOL Invision Power.

[Khyber]

Their entire suite of software is shit and vulnerable. IPBoard is a complete piece of utter garbage where features that forums should have by default are pay-for plugins.

He who smelt it, dealt it

[Anonymous Coward]

Or this is a story told by Surfwatch to promote itself as a security research company.

In the absense of verifiables, and with the obvious questions (how can it be a secret plan and yet Surfwatch know about it?), How could Surfwatch have known *intent* of attacker?), I'm inclined to view this as part or all PR.

Re:He who smelt it, dealt it

[Anonymous Coward]

You don't promote yourself by advertising that another company was hacked. That's how you get sued.

Re:He who smelt it, dealt it

[Anonymous Coward]

That's how they all do it, even the big names

Re: He who smelt it, dealt it

[Anonymous Coward]

For?

Seen the ad

[Anonymous Coward]

I've actually seen the ad on the darknet. Glad someone reported it. Kinda stupid to advertise a thing like that out in the open.

99 problems

[Anonymous Coward]

if you're using IP.Board I feel bad for you son.... i have 99 problems but that crappy forum ain't one