bugtraq - Re: what is this?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.62.0801141541060.12183@linuxbox.org>
Date: Mon, 14 Jan 2008 15:46:05 -0600 (CST)
From: Gadi Evron <ge@...uxbox.org>
To: crazy frog crazy frog <i.m.crazy.frog@...il.com>
Cc: Untitled <full-disclosure@...ts.grok.org.uk>,
	PenTest <pen-test@...urityfocus.com>, bugtraq@...urityfocus.com
Subject: Re: what is this?

> Hi,
>
> Recently on opening one of my site,my antivirus pops up saying that it
> has found on malicious script.the url is random and i have managed to
> get tht script.it is using some flaw in apple quick time.
> u can get the zip file for java script here:
> http://secgeeks.com/what.zip
> password is 12345
> can somebody guide/help me what is this and how can i remove it?

I did not look at the malware, but it is pretty obvious you have been 
compromised.

Defacements today (unless for specific reason of being "seen") are about 
leaving the site the same way you find it, and infecteing its user 
base/visitors.

A second option is that you are secure but a "partner" such as ad sites 
has been compromised and infects your users.

Naturally, a compromise can come from anywhere, but in most cases it is 
something like RFI... Taosecurity linked to three great papers on the 
subject of web botnets / cross-platform web malware:
http://taosecurity.blogspot.com/2007/11/great-papers-from-honeynet-project.html

Linking also to my original article here:
http://blogs.securiteam.com/index.php/archives/815

 	Gadi.