Shodan Search Engine Will Find Thousands Of Hacked Websites

Many websites hacked and leave a message of the attacker behind often with "Hacked by" begins. The developer of the search engine Shodan is using this term were found thousands of websites have been hacked recently and were provided with the text "Hacked by."

Shodan is known as search engine that sorts of devices connected to the Internet, such as printers , routers, cameras and even complete industrial SCADA systems can be found. However, the search engine indexes also websites. The research that developer John Matherly conducted revealed that many of the hacked websites were hosted by one provider. A quarter of the "Hacked by" sites was in fact housed in the E commerce Corporation.

Almost all servers of this hosting company running on Apache and PHP, although not all have the same versions. Continue turning the most hacked websites not entirely surprised on port 80 (HTTP). Matherly also wanted to know what attackers had most websites and so could create a Top 10, where "GHoST61" 57 defacement's ends on the first place. The investigation of the Shodan developer late unfortunately not see how the sites were compromised.

Domain Lenovo.com Hijacked Through DNS Adjustment

Attackers there yesterday managed to Lenovo.com hijack the DNS of the domain name to suit . Earlier this week, the attackers used the same technique in the Vietnamese Google website. In both cases Lizard Squad behind the DNS changes, as reported OpenDNS.

The Domain Name System (DNS) is similar to the directory and translates among other domain names into IP addresses. The DNS servers Lenovo.com and Google.com.vn change the attackers could then specify the IP addresses where the domain was pointing to. The IP address of the mail server could be modified so that emails for Lenovo.com found themselves at the attackers. In the case of Google.com.vn be the site for a Dutch IP address. Meanwhile, both websites are accessible again and the DNS changes undone.

On Twitter was the Malaysian Registrar WebNIC where both domain names are registered, then with the DNS adjustments in connection brought . IT journalist Brian Krebs reports that Webnic.cc via a command injection vulnerability has been hacked, leaving a rootkit could be uploaded. This rootkit would already have been removed. The website of WebNIC is still unreachable.

1800 Subdomains Used For Flash Player Attack

Cybercriminals last week a large number of subdomains created and used for attacking Flash Player users. For carrying out the attack, the attackers used more than 50 legitimate GoDaddy accounts that they had hijacked. GoDaddy is an Internet domain registrar where to register. In addition, customers can through the GoDaddy account to manage their domain names. By this steal account information the attackers had access to a large number of domain names.

They used the access to create subdomains , which were then used to host a Flash Player exploit. This is an exploit for a vulnerability in Adobe Flash Player that on January 26 was patched this year. The use of subdomains took place between 26th and 30th of January. Unlike many attacks where cyber criminals hacking and using legitimate websites to infect visitors were not adjusted in this case the main domains.

The attackers used the subdomains created to host the Flash Player operates as well as an exploit for Microsoft Silverlight.Contaminated ads was then made ​​to these subdomains. Users with vulnerable Flash Player who got to see could be infected with malware in this way the ads, according to Cisco . Statistics from VirusTotal shows that exploits barely detected by virus scanners, which indicates that it is important to immediately install the available updates.

Google Adsense Used For Malicious Ads

Cybercriminals have used Google Adsense to display ads on all sorts of malicious websites that visitors to these sites for several scam sites by sent. Numerous webmasters complained about the ads that ensured that visitors were redirected automatically.

The scam sites where visitors ended up offered all kinds of products to lose weight, aging combat, combat skin problems or improve IQ. The websites looked like blogs and magazines with so-called scientific studies and research on the products, complemented by all kinds of false responses from people who supposedly had tried the products.

The problem with the malicious ads would play since mid-December, but was last Friday, January 9th widely felt. On the Google AdSense forum, more than 180 responses from angry webmasters inside. Webmasters who use Google Adsense on their websites and see how visitors were redirected by the malicious ads.

On January 10, Google would have solved the problem. According to security firm Sucuri used the attackers behind the attack two legitimate AdSense campaigns, they probably via guessed or stolen credentials managed to hijack. However, it is not excluded that the scammers Adsense accounts have created yourself and initially did occur that it was legitimate campaigns.
Code

Researcher Denis Sinegubko of Sucuri is wondering why Google allows advertisers may use this type of potentially dangerous code. "I realize that Google advertisers flexibility in managing their campaigns and the use of scripts will give their own pages. And I realize that at the first check these scripts did nothing malicious, and is only misbehaved after they were approved. But there would have to be more in control of third-party scripts. "

Sinegubko further notes that nobody likes ads, but they are indispensable for many websites. "I will not tell you to remove all ads from your site," he says to webmasters. "But I ask you to think about the safety and reputation effects that may have bad ads for your site. Consider each script from a third party that you place on your website as a potential threat. Especially those scripts that others who do not knows, allow you to place content on your site. "

Previously we already seen the Malicious Ads Distributed By AOL Advertisement's Network and Users Report Malicious Ads On Skype.

ESET & Facebook Works Together To Fight Against Malware

To protect users from malware, Facebook has signed a cooperation agreement with ESET's online virus scanner and will of the Slovak anti-virus company now offer to users. The online virus scanner is to start directly from Facebook.

"We have cooperated with ESET to add their security software directly to our detection and prevention systems, just as we did earlier this year with the other providers," says Facebook engineer Chetan Gowda. Facebook previously signed a similar agreement with the Finnish F-Secure and Japanese Trend Micro online virus scanners which were already integrated into Facebook.

If the computer of a Facebook user behaves erratically and shows signs of a malware infection, a message appears that an online virus scan is offered. Then, the user can perform the scan, the results and remove malware without the need to first log out of Facebook.

According Gowda help the three anti-virus companies in this way in blocking malicious links and malicious websites in the news feeds and messages from the 1.35 billion Facebook users. Users often miss the most basic security to prevent infection and remove, observes the engineer on.

Google - Captcha Fighter Against Robots

Google has a new captcha developed to distinguish people on websites of robots, whereby it is no longer necessary to solve a puzzle first. CAPTCHAs are used inter alia for the automatic creation of accounts and post spam on websites counter.

To often distinguishable robots people must puzzles and distorted texts are resolved. Google uses recaptcha example, where there are words from books must be retyped. Our own research shows that the search giant artificial intelligence with an accuracy of 99.8% can solve the puzzles. According to Google would therefore be much easier to apply directly to users whether they are human or robot. This allows users to quickly register or use of a service, which also eliminates the annoyance of solving the captcha.

API

A new API (Application Programming Interface) makes this captcha experience now possible. On websites that use the API receives a large number of users the ability to attach a single click that they are not a robot. Although this sounds simple, the underlying technology is complex, according to the search giant. Last year was a special backend developed that performs a risk if users want to solve a captcha.

On the basis of the way in which the user handles were examined with the captcha or the user was a human. The new API is a development of this, which is looked at many factors which indicate that it is a human being. Where does the risk of insufficient evidence to make this decision will appear captcha again. In addition, the API also makes it possible to test other types of captcha's. The new API would now be used on various websites, including Snapchat, WordPress and Humble Bundle.

Barracuda launches Threat Glass

Barracuda Networks, the provider associated with the cloud storage solutions and ICT security, introduces Threat Glass, an online tool for searching, analysis and exchange of information on websites with malware. With Threat Glass users can see reviews of the infected websites with screenshots of the stages of infection and analyze network issues.

Daily popular websites cyber criminals exploited to. Malware to visitors loose Threat Glass of Barracuda Networks offers both casual users and the research community the opportunity to bring this persistent problem, identify and understand better. Threat Glass was developed as a front-end to a large-scale automated system that uses lightweight visualization for the independent detection of vulnerabilities and abuse thereof (exploits). The platform analyzes millions of websites every week. The websites that are submitted for inspection from various data feeds, including the top 25,000 websites by Alexa, social feeds and suspicious sites that are detected by the worldwide network of customers Barracuda, which spans more than one hundred fifty thousand organizations. Besides screenshots of the infection Threat Glass offers different views of network traffic, including DNS, HTTP and Net flow, in both graphic and text format. The system has about ten thousand live web-based malware attacks mapped to date and adds daily information on new events added.Detection engines from Barracuda Labs have numerous malware infections found in reputable websites. In recent months Barracuda Labs has published analyzes of popular websites like Cracked.com, Php.net and Hasbro.com.Information on this and thousands of other infected websites is now available through Threat Glass.