St. Petersburg consulate Web site hacked
558713
(InfoWorld) - Security vendors are warning that two U.S. Department of State Web sites based in Russia could contain malware and should be avoided. The most serious compromise was on the Web site for the U.S. Consulate General for St. Petersburg. About a week ago, researchers at Sophos PLC discovered that the site had been hacked and was apparently serving up malicious software to visitors. The compromise seems to have been short-lived. By the time researchers were able to check the site manually, the infection had been cleaned up. By looking at a cached version of the page in question, however, they were able to find the malicious code in question. A State Department spokeswoman said she was unaware of any breach. As of Thursday, Sophos customers were still being blocked from accessing the St. Petersburg consulate Web server, which is hosted on the stpetersburg.usconsulate.gov and www.stpetersburg-usconsulate.ru domains. The St. Petersburg consulate site was probably not deliberately targeted because it was one of about 400 sites infected by the criminals behind the hack, said Ron O'Brien, a senior security analyst with Sophos." The malware writer was looking for vulnerable sites and happened upon that site," he said. Attackers were using these compromised servers to install Trojan software on victim's computers, O'Brien said. "It was a malware that allowed for remote access and it also attempted to download additional malware from a remote server." These type of Web-based attacks have become increasingly common over the past years as criminals have created a number of kits, designed to lure victims to compromised Web sites and where unauthorized software is installed on their PCs. Webattacker is the best-known of these kits. Separately, McAfee's SiteAdvisor software is now warning Web surfers not to visit the State Department's Moscow embassy Web site. According to a SiteAdvisor alert, this site has been associated with e-mail messages that contained computer viruses. "After entering our e-mail address on this site ... we received two e-mails that contained a virus," McAfee said in the alert.
457591
Hackers revealed exploit code for JavaScript vulnerability.
231058
Hackers reprogrammed the Web site for the Super Bowl stadium so it would automatically load a malicious script, security firm said.
146885
(InfoWorld) - Usernames and passwords for more than 100 e-mail accounts at embassies and governments worldwide have been posted online. Using the information, anyone can access the accounts that have been compromised. Computer Sweden Â has verified the posted information and spoken to the person who posted them. The posted information includes names of the embassies and governments, addresses to e-mail servers, usernames and passwords. Among the organizations on the list are the foreign ministry of Iran, the Kazakh and Indian embassies in the U.S. and the Russian embassy in Sweden. Freelance security consultant Dan Egerstad posted the information. He spoke openly about the leak when Computer Sweden contacted him. "I did an experiment and came across the information by accident," he said. Egerstad says he never used the information to log in to any of the compromised accounts in order not to break any laws. Computer Sweden confirmed that the login details for at least one of the accounts is correct. Egerstad forwarded an e-mail sent on Aug. 20 by an employee at the Swedish royal court to the Russian embassy. The person who sent the e-mail, in which she declines an invitation to the Russian embassy, has confirmed that she sent the e-mail. "Yes, that is right. We did decline the invitation. As far as I can remember I did send the e-mail," she said. Computer Sweden has not been able to confirm the authenticity of any of the other information that has been posted. "When something like this happens you usually contact people and ask them to fix it. But in this case it felt too big for that, calling to other countries," Egerstad said. Of the compromised accounts, 10 belong to the Kazakh embassy in Russia./p> Around 40 belong to Uzbeki embassies and consulates around the world. Login details for e-mail accounts at the U.K. visa office in Nepal were also posted. Login details for the foreign ministry of Iran, the Kazakh and Indian embassies in the U.S. and the Russian embassy in Sweden were also posted. "I hope this makes them take action. Hopefully, faster than ever before, and I hope they become a bit more aware of security issues," Dan Egerstad says. Computer Sweden has contacted both the Russian and Indian embassies in Stockholm for comment. The Russian embassy confirmed the leaks and says that logins have now been changed. The Indian embassy declined to confirm the information and give comment. Computer Sweden has not published where the login details can be found. The information in this story has been verified by Computer Sweden without using any of the published login details. Computer Sweden is an InfoWorld affiliate.
332998
A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday.
625347
(InfoWorld) - Security experts are finding an increasing number of Web sites hosting malicious JavaScript code firstÂ detected on Super Bowl-related sitesÂ last week. Sites covering topics ranging from health care to government have been hacked to host the JavaScript, SANS Internet Storm Center Director Marcus H. Sachs wrote on the SANS blog, listing some of the hacked sites. "System administrators might want to check their network flow logs for any traffic to these sites and for any traffic to the five sites that hosted the hostile JavaScript," Sachs wrote. The attack targets two known vulnerabilities in Microsoft's Windows operating systems, for which patches were issued in April and January. Computers with unpatched software are vulnerable to the attack. If one of the hacked sites is visited, the JavaScript code directs the browser to a second Web server, based in China, and tries to install a Trojan Horse downloader and password-stealing program on the victim's computer. Initially, the exploit appeared isolated to Web sites related to U.S. football, as hackers tried to capitalize on the surge of traffic to sites concerning the Super Bowl sporting event, which was played on Sunday. The site of the Miami Dolphins team, and another site for its stadium, were hacked, although they were eventually cleaned up. Security company WebsenseÂ reported the problem on the stadium site on Friday. Websense recommended that users stay away from the affected sites until they had been cleaned up. Â
123469
Internet hackers crashed the Web  site of Panama's National Assembly and briefly posted an  American flag there, four months after the legislature elected  as its leader a man accused of murdering a U.S. soldier.
532163
Hackers on Tuesday attacked a Web site of an al Qaeda-linked group that beheaded two U.S. hostages in Iraq, rerouting visitors to a page showing a penguin toting a machine-gun and warning against hosting such sites.
184713
Neighbourhood watch A global road map of the riskiest and safest places to surf online found Russian and Romanian sites among the top-level domains most commonly hosting malicious downloads, browser exploits, and scams.â¦
681333
A cache found online of usernames and passwords for more than 100 government e-mail accounts includes takings from Iranian, Russian, Indian, U.K., and Kazakh victims.
732894
(InfoWorld) - A hacker successfully attacked a Web page within Microsoft's U.K. domain on Wednesday, resulting in the display of a photograph of a child waving the flag of Saudi Arabia. It was "unfortunate" that the site was vulnerable, said Roger Halbheer, chief security advisor for Microsoft in Europe, the Middle East and Africa, on Friday. The problem has since been fixed. However, the hack highlights how large software companies with technical expertise can still prove vulnerable to hackers. The hacker, who posted his name as "rEmOtEr," exploited a programming mistake in the site by using a technique known as SQL (Structured Query Language) injection to get unauthorized access to a database, Halbheer said. The site took SQL queries of a particular form, embedded in URLs (uniform resource locators), and passed them to a database. By embedding a query with an unexpected form in the requested URL, the hacker prompted the server to return error messages, Halbheer said. From those error messages, a hacker can get an idea of how the database is structured and refine a SQL query that the database will process as an instruction to insert, rather than retrieve, data. Eventually, the hacker found the right combination and inserted a link to an external Web site into the database. That meant when the normal Web page was called into a browser, the database would download data from an external link. In this case, it was two photos and a graphic, a screen shot of which is available on Zone-H.org , which tracks hacked Web sites. There are two ways to avoid this style of attack. First, the database should not be allowed to return error messages, Halbheer said. Secondly, the Web application should have validated the URL the hacker entered and rejected ones that should not be processed, he said. If a programmer makes a mistake, "the bad guy can leverage it," Halbheer said. SQL injection attacks are on the rise, overall, since valuable data is held within databases, said Paul Davie, founder and chief operating officer of Secerno, a security vendor that develops technology to protect databases from SQL attacks. "I don't think Microsoft are unique in this respect and shouldn't be held up as particularly slipshod," Davie said. "This could have happened to practically anybody."
196504
Security nightmare for DreamHost Hackers have been able to load malware onto the official Mercury music awards site, as well as hundreds of other sites, after breaking into the systems of US-based hosting firm DreamHost.â¦
576139
eTrust Antivirus mistook a critical security process for malware.
240297
A hacker has successfully attacked a Web page within Microsoft's U.K. domain.
703103
Hackers co-opted several popular Web sites including comedycentral.com over the weekend, using them to infect thousands of computers with a virus that can be used to steal passwords, bank accounts and other personal information. -washingtonpost.com
94093
An intruder could manipulate a flaw in how the browsers handle image files to see where the user has been surfing.
578705
He's ba-ack A hacker has once again managed to pilfer eBay credentials that allow him to masquerade as an official company representative even as he taunts eBay officials on the company's message boards. It's at least the second time the person going by the name Vladuz has pulled off the prank, which is causing many users to question the adequacy of eBay security.â¦