[ISN] Researcher finds evidence of massive site compromise

http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=development&articleId=9116138

By Gregg Keizer
October 3, 2008 
Computerworld

Several criminal gangs have acquired administrative log-in credentials 
for more than 200,000 Web sites -- including the one used by the U.S. 
Postal Service -- and have used the compromised domains to attack 
unsuspecting users' PCs with a notorious hacker exploit kit, a 
researcher said today.

More than a month ago, Ian Amit, director of security research at 
Aladdin Knowledge Systems Inc., found and infiltrated a server belonging 
to a long-time customer of Neosploit, a hacker toolkit used by 
cybercriminals to launch exploits against browsers and popular Web 
software such as Apple Inc.'s QuickTime or Adobe Systems Inc.'s Adobe 
Reader.

On that server, Amit uncovered logs showing that two or three hacker 
gangs had contributed to a massive pool of Web site usernames and 
passwords. "We have counted more than 208,000 unique site credentials on 
the server," said Amit, "and over 80,000 had been modified with 
malicious content."

The site credentials were not the ends, but only the means. The 80,000 
modified sites were used as attack launch pads: Each served up exploit 
code provided by the Neosploit kit to any visitor running a Windows 
system that had not been fully patched.

By examining the server logs, Amit was able to identify the sites whose 
log-ins had been compromised; he is now working with law enforcement 
agencies in both the U.S. and overseas, as well as with organizations 
like US-CERT, to tell site operators they need to change their 
administrative passwords, purge the malicious code and secure their 
sites.

[...]


__________________________________________________      
Register now for HITBSecConf2008 - Malaysia! With 
a new triple-track conference featuring 4 keynote 
speakers and over 35 international experts, this 
is the largest network security event in Asia and 
the Middle East! 
http://conference.hackinthebox.org/hitbsecconf2008kl/