Author Archives: David Dede

About David Dede

Sucuri Security bot (crazy work) - Malware research updates, sucuri news and more.

Ask Sucuri: How Long Does It Take For a Site To Be Removed From Google’s Blacklist? – Updated

Posted on December 14, 2011 by David Dede

If you have any questions about malware, blacklisting, or security in general, send it over to us: contact@sucuri.net and we will answer here. For all the “Ask Sucuri” answers, click here This is an update to our previous post about … Read more


Posted in ask, blacklist, blacklisted, google, sucuri | Tagged , , , , | 1 Comment

WordPress 3.3 is Out

Posted on December 12, 2011 by David Dede

For all our WordPress users, please remember to update to WordPress 3.3 that was just released. It should be a quick 1-click process in your dashboard, and nobody have an excuse not to do so. And if you are currently … Read more


Posted in wordpress | Leave a comment

The New (and Old) .htaccess Attacks – Now Using .in Domains

Posted on November 28, 2011 by David Dede

We have been talking about .htaccess redirections for a while. A site gets compromised and the attackers modify the .htaccess file(s) to redirect any search engine traffic to a different (malicious) page that attempts to compromise the browser / computer … Read more


Posted in hacked, htaccess, malware, malware_updates, wordpress | Tagged , , , , , | 2 Comments

Dre Armeda: WordPress End-User Security

Posted on November 19, 2011 by David Dede

Sucuri Co-Founder Dre Armeda did a great presentation at WordCamp Chicago about end-user security for WordPress users. Check out the video here: Dre will also be speaking at WordCamp Las Vegas 2011, make sure to say hi if you’re attending.


Posted in security, sucuri, wordpress | Tagged , , | 5 Comments

Joomla 1.5.25/1.7.3 Released (Security Update)

Posted on November 15, 2011 by David Dede

If you are using Joomla, now is the time to update it. A new version was just released for the 1.5.x and 1.7.x branches fixing a high priority security issue that will allow remote users to change other users passwords … Read more


Posted in joomla, vulnerability | Tagged , | 3 Comments

Htaccess Redirection to Sweepstakesandcontestsinfo dot com

Posted on November 14, 2011 by David Dede

Last week we started to see a large increase in the number of sites compromised with a .htaccess redirection to http://sweepstakesandcontestsinfo.com/nl-in.php?nnn=555. This domain has been used to distribute malware for a while (generally through javascript injections), but only in the … Read more


Posted in hacked, htaccess, malware, malware_updates, vulnerability | Tagged , , , , | 3 Comments

Timthumb.php Mass Infection – Aftermath – Part I

Posted on October 28, 2011 by David Dede

If you use WordPress you’re probably aware of the mass infection caused by a vulnerability in the timthumb.php script, a photo manipulation script included in many themes and plugins. Sites were compromised with anything from malware to Blackhat SEO spam, … Read more


Posted in hacked, malware, malware_updates, vulnerability, wordpress | Tagged , , , , | 28 Comments

MyBB web site and downloads compromised

Posted on October 25, 2011 by David Dede

It’s not good when your site gets infected with malware, specially if you’re a provider of software to many. If you are using MyBB (forum software), please be aware that their web site hacked and the software download packages compromised: … Read more


Posted in backdoors, vulnerability | Tagged , | Leave a comment

Evil backdoors – Part II

Posted on October 14, 2011 by David Dede

A few months ago we did a post about backdoors, explaining how they work and how to look for them. If you didn’t read it, take a read here: ASK Sucuri: What about the backdoors? However, we still see on … Read more


Posted in backdoors, hacked, malware, malware_updates, wordpress | Tagged , , , | 15 Comments

Mass infections from jjghui.com/urchin.js (SQL injection)

Posted on October 12, 2011 by David Dede

We are seeing many sites compromised with malware from jjghui.com/urchin.js. Most of them are IIS/ASP sites and the infection method seems to be similar to the Lizamoon mass infections from a few months ago (SQL injection). According to Google, almost … Read more


Posted in hacked, iis, malware, malware_updates, vulnerability | Tagged , , , , | 8 Comments
RSS Delicious