Malware week: The div_colors, CreateCSS and others
David Dede We are starting to see an interesting trend regarding how the latest web-based malware is being distributed. Instead of heavily encoding the malicious code on…
MySQL.com compromised
MySQL.com (the official site for the MySQL database) was compromised via (shocking!) blind SQL injection. A post was sent today to the full disclosure list…
Database injection and lessthenaminutehandle.com – Intermediary domains
We posted a few days ago about a large scale database injection attack affecting shared hosts. The infected sites got the following javascript malware inserted…
Attacks against IIS/ASP sites – alisa-carter dot com
Over the last few days, we’ve seen a number of sites getting hacked with a malware script pointing to http://alisa-carter.com/ur.php . It is done using…
Tumblr mistake or security issue
There is a post on Hacker News about a possible security issue with Tumblr. Basically a lot of confidential information, including server IPS, API keys,…
Database injection, Hilary Kneber and lessthenaminutehandle dot com
We posted a few weeks ago about a database injection attack that infected thousands of WordPress blogs on shared hosts. At that time, the attackers…
Solution for the link injection spam from basicpills
We recently posted about a large scale blackhat SEO campaign by basicpills that infected thousands of WordPress sites over the last few weeks. A lot…
Oracle.com, Wetpaint, Spammers, and the Tale of an Unmoderated Wiki
Update: A few hours after this post going live, it seems that Oracle started to clean up the wiki. Very good! Oracle’s official Wiki (at…
Link injection, basicpills dot com and Blackhat SEO spam
For the last few weeks we’ve been tracking a very large blackhat SEO spam campaign initiated by basicpills.com, generic-ed-pharmacy.com, getrxpills.com and a few other domains…
Malware week – 0133.0331.0242.0033, javadisplay and more
Very busy week in terms of malware. First Hilary Kneber decided to make a come back, inlovebot.com and crazymasya.com reinfected a lot of sites, and…
Hilary Kneber Again – welcometotheglobalisorg
We are seeing (again) a number of sites infected with a variation of the welcometotheglobalisnet.com malware string that appeared a few weeks ago. The details…