full-disclosure - Indusface Website Hacked and Infected?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 15 May 2013 14:46:23 +0530
From: Rahul T <rt184221@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Indusface Website Hacked and Infected?

Dear All,

I was searching for some information on the internet and it seems that the
Indusface website was infected with Russian Spam and Malware. There seems
to be spam and malicious code in the homepage along with many more spam
pages added into the webroot. Below are some screenshots of the same:

*Indusface Homepage Infected with Russian Spam*
*
*
*[image: Inline image 2]
*
*
*
*Google Search Results Showing Indusface Pages with Russian Spam and Malware
*

[image: Inline image 1]

*These Spam Pages on the Indusface Website Contain Potentially Malicious JS
Files*
*
*
*[image: Inline image 3]
*
*
*
*[image: Inline image 4]
*

Does anyone know how this sort of hack takes place? Please let me know any
information possible.

Thanks - Rahul

Content of type "text/html" skipped

Download attachment "Google_Search_Page.jpg" of type "image/jpeg" (35138 bytes)

Download attachment "Potentially_Malicious_JS2.jpg" of type "image/jpeg" (45895 bytes)

Download attachment "Potentially_Malicious_JS.jpg" of type "image/jpeg" (30254 bytes)

Download attachment "Homepage_Infected.jpg" of type "image/jpeg" (72260 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/