Sponsored by..

Thursday, 13 March 2008

trendmicro.com compromised - sort of.

McAfee has flagged up another mass defacement on their blog here, various sites have been injected with a reference to hxxp:||www.2117966.net|fuckjp.js (I assume that you can undo the trivial obfuscation if you really, really want to look).

A Google search for 2117966 fuckjp.js shows over 9000 hits. Obviously you won't want to visit any of these infected sites, so take care.

However, one of the sites showing up is trendmicro.com (see screenshot). At the time of writing, the Trend Micro site has been cleaned up, and it looks as though the infection wouldn't have worked on that particular site. Nonetheless, it is always worrying when you see a security vendor site compromised in this way. This isn't the first time this has happened to this type of site - CA.com was infected back in January.




The Google cache gives away the infection (use WGET, SamSpade or a non-Windows machine to examine the cache, never a full blown browser on a Windows system).

This is the current (clean) version of www.trendmicro.com/vinfo/grayware
/ve_graywareDetails.asp?GNAME=TSPY_LINEAGE&VSect=St




The infected version (from the cache) shows the altered code:



A close look at the code shows that the injection has been borked somewhat and wouldn't actually work. However, there were potentially hundreds of infected pages, some of which may have been more successful in injecting malware.

The date of the Google cache is or or about 4th March, so a week ago.

2117966.net is on 125.46.105.224 in China, at the time of writing the site is down, however the Google cache comes up with something funny for the front page:



Hacker humour?

Anyway, I have no particular axe to grind against Trend Micro, they have a decent set of products and are one of the more useful companies in the security arena. Again, it just goes to show that even trusted sites can be compromised.

4 comments:

optimints said...

Hi, Do you know what is the vulnerability that allowed the website to be injected with the malicious url?

Conrad Longmore said...

No, they're usually a SQL / mySQL flaw though.

Aa'ed Alqarta said...

these are very aggressive attacks, and system admins should be ready to prevent their clients from getting exploited and redirected to those malicious domains.

check here

http://extremesecurity.blogspot.com/2008/03/iframe-attacks-actions-to-be-taken.html

SecPoint Blog said...

http://www.secpoint.com