From: InfoSec News (alertsinfosecnews.org)
Date: Fri Oct 03 2008 - 01:29:50 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=development&articleId=9116138

By Gregg Keizer
October 3, 2008
Computerworld

Several criminal gangs have acquired administrative log-in credentials
for more than 200,000 Web sites -- including the one used by the U.S.
Postal Service -- and have used the compromised domains to attack
unsuspecting users' PCs with a notorious hacker exploit kit, a
researcher said today.

More than a month ago, Ian Amit, director of security research at
Aladdin Knowledge Systems Inc., found and infiltrated a server belonging
to a long-time customer of Neosploit, a hacker toolkit used by
cybercriminals to launch exploits against browsers and popular Web
software such as Apple Inc.'s QuickTime or Adobe Systems Inc.'s Adobe
Reader.

On that server, Amit uncovered logs showing that two or three hacker
gangs had contributed to a massive pool of Web site usernames and
passwords. "We have counted more than 208,000 unique site credentials on
the server," said Amit, "and over 80,000 had been modified with
malicious content."

The site credentials were not the ends, but only the means. The 80,000
modified sites were used as attack launch pads: Each served up exploit
code provided by the Neosploit kit to any visitor running a Windows
system that had not been fully patched.

By examining the server logs, Amit was able to identify the sites whose
log-ins had been compromised; he is now working with law enforcement
agencies in both the U.S. and overseas, as well as with organizations
like US-CERT, to tell site operators they need to change their
administrative passwords, purge the malicious code and secure their
sites.

[...]

__________________________________________________
Register now for HITBSecConf2008 - Malaysia! With
a new triple-track conference featuring 4 keynote
speakers and over 35 international experts, this
is the largest network security event in Asia and
the Middle East!
http://conference.hackinthebox.org/hitbsecconf2008kl/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]