full-disclosure - Re: what is this?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <41011d980801142212l7fdb2b33n632dfacdeedba631@mail.gmail.com>
Date: Tue, 15 Jan 2008 11:42:33 +0530
From: "crazy frog crazy frog" <i.m.crazy.frog@...il.com>
To: Denis <sp23@...ernode.on.net>
Cc: Untitled <full-disclosure@...ts.grok.org.uk>, bugtraq@...urityfocus.com
Subject: Re: what is this?

well,
i received many response but no one is perfact.i checked the files and
didn't find anything embeded in my scripts or pages.still i have to
figure out why my antivirus randomly popsup?i mean most of the times
it doesnt detect any infection but then suddenly this thing happnes
and then everything seems ok.
i dont think its a problem with my script otherwise i could have find
the code or it should be repeating consistly.has any one still facing
this issue in the techicorner.com or on tubeley.com or on
secgeeks.com?

let me know i m trying hard to digg this issue.

On Jan 15, 2008 10:46 AM, Denis <sp23@...ernode.on.net> wrote:
> This is a very serious new threat affecting Linux servers and thousands
> of boxes have been compromised since December 2007.
>
> Each box serving the nasty javascript has been rooted. One person has
> found a way to CLEAN the infection (ie. stop your server from serving
> the bad javascript), however not the root hole ie. the servers in
> question are still rooted as nobody so far has found what hole is being
> exploited to gain root access in the first place.
>
> See the following urls for a lot more info on this exploit:
>
> http://www.webhostingtalk.com/showthread.php?t=651748 (useful discussion
> starts on page 3 or so)
>
> http://www.theregister.co.uk/2008/01/11/mysterious_web_infection/
>
> Time for some honey pot action to find out how they're gaining root
> access to begin with. From all reports so far it does not appear to be a
> kernel vulnerability (as some of the affected servers were using latest
> kernels)
>
> Cheers,
> Denis
>
>
> On Sun, 13 Jan 2008 21:31:34 +0530
> "crazy frog crazy frog" <i.m.crazy.frog@...il.com> wrote:
>
> ---> Hi,
>
> --->
> ---> Recently on opening one of my site,my antivirus pops up saying that it
> ---> has found on malicious script.the url is random and i have managed to
> ---> get tht script.it is using some flaw in apple quick time.
> ---> u can get the zip file for java script here:
> ---> http://secgeeks.com/what.zip
> ---> password is 12345
> ---> can somebody guide/help me what is this and how can i remove it?
> --->
> ---> --
> ---> advertise on secgeeks?
> ---> http://secgeeks.com/Advertising_on_Secgeeks.com
> ---> http://newskicks.com
>
> Denis
>

-- 
advertise on secgeeks?
http://secgeeks.com/Advertising_on_Secgeeks.com
http://newskicks.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/