×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Malware Pulls an "Italian Job"

kdawson posted more than 6 years ago | from the blame-italy dept.

Security 133

A number of readers sent us word about a malware attack that has been underway since Saturday that began with the compromise of more than 1,100 mostly Italian Web sites. Websense claims that more than 10,000 sites have been infected by now, 80% of them in Italy. There are indications that most of the Italian sites are resident at the same large Italian hosting provider. Trend Micro reports on the attack, which is launched from a malicious Iframe tag inserted into pages on compromised sites. For visitors to these sites, this begins a cascade of "drive-by" malware downloads if one of several targeted vulnerabilities is available and unpatched. The first page to which visitors are redirected by the Iframe hosts a recent version of Mpack attack software. Panda has a month-old report on Mpack (PDF) that provides copious detail about its nefarious ways.

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

133 comments

snape dies lolololo (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#19560285)

I was always so suspicious of him. [imageshack.us]
It's not your fault. The important thing is that you came through in the end, Harry
But I still feel like I should have taken him more seriously. Trusted him more. I always... I don't know.
Out of habit, Rimulus quickly looked at both sides to see that there was no one else there to see to hear, even though it was impossible for anyone to be there without him noticing.
Look, Severus knew what he needed to do in the end. If he hadn't wanted to help us he wouldn't have, and we would never have found the horcrux in Sirius's house. And you saw how Severus went down. Someone who doesn't care wouldn't have faced up to Him like that and been willing to die that way.
You're right.
Harry paused for a moment for another thought.
It hurts anyway, though, he sobbed.
That's perfectly fine.
It's weird but I feel guilty that I never listened to him or I never took him seriously in a good way.
Harry, listen to me.
Harry turned to pay his full attention to Rimulus. Trying to keep his focus on the tall man's taut face took a lot of effort, and he didn't feel any better yet.
Severus knew you couldn't trust him. That doesn't make you a bad person, Harry. He understood you better than we give him credit for, that's why he was able to make that decision.

Why do they never come right out and say... (0, Troll)

Chris Tucker (302549) | more than 6 years ago | (#19560295)

...that it's Windows machines that get 0wned.

Don't use Windows, don't get 0wned.

Re:Why do they never come right out and say... (-1, Flamebait)

Cheezymadman (1083175) | more than 6 years ago | (#19560337)

Don't use Mac, don't look like a douche.

The only reason that no one codes Mac virii is because no one gives a shit about Macs.

Re:Why do they never come right out and say... (4, Funny)

MadUndergrad (950779) | more than 6 years ago | (#19560405)

Speaking of looking like a douche, it's "viruses". I'll say it again, "viruses". Not virii.

Re:Why do they never come right out and say... (1)

Cheezymadman (1083175) | more than 6 years ago | (#19560493)

I guess you're going to tell me that it's "cactuses" and "octopuses" now, right?

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19561257)

What would be the point in that? You obviously can't handle being corrected anyway.

Re:Why do they never come right out and say... (1)

svunt (916464) | more than 6 years ago | (#19561427)

You silly man. Octopus is GREEK octo=eight pus=foot, so octopuses is fine, or octopodes would sort of work too (podes=feet), but only sorta.

Re: Viruses/Viri/Virii (5, Informative)

beav007 (746004) | more than 6 years ago | (#19560563)

From http://en.wikipedia.org/wiki/Virii [wikipedia.org] :

In the English language, the standard plural of virus is viruses. This is the most frequently occurring form of the plural, and refers to both a biological virus and a computer virus.

The less frequent variations viri and virii are virtually unknown in edited prose, and no major dictionary recognizes them as alternative forms. Their occurrence can be variously attributed to hypercorrection formed by analogy to Latin plurals such as alumni or false analogy to Latin plurals such as radii; idiosyncratic use as jargon among a group, such as computer hackers; and deliberate word play, such as on BBSs (see, e.g.: leet).

Yes, viri/virii is incorrect (for now), but when the vast majority of us don't RTFA (or can't, due to the /. effect), you can hardly expect people to figure it out all on their own ;)

Re: Viruses/Viri/Virii (0, Redundant)

Anonymous Coward | more than 6 years ago | (#19560641)

Two Points:
  • English is an evolving language, and "virii" is fairly commonly used in the context of malware. Not being, as yet, recognized by "major dictionaries" is hardly a limitation on the use and adoption of industry-specific terminology.
  • Surely by now everyone on \. is aware that, while somewhat informative, and often interesting, Wikipedia has never been deemed authoritative.


-AC

Re: Viruses/Viri/Virii (1)

zoogies (879569) | more than 6 years ago | (#19560999)

It may be commonly used, but virii is stupid. Where did it come from? People trying to look knowledgeable about latin? Then viri makes sense; you know, because it's the plural of the actual latin word "virus" (which means 'man,' not virus or bug or anything even closely related). VIRUSES. IT'S NOT A DAMN LATIN WORD, PEOPLE.

Re: Viruses/Viri/Virii (4, Informative)

Anonymous Coward | more than 6 years ago | (#19561245)

Vir means man. Its plural is viri. Virus is a different word, a rare 2nd declension neuter, meaning (among other nasty things) 'poison'. It has no plural.

But I agree with you, virii is both bad English and bad Latin.

Re: Viruses/Viri/Virii (0)

Anonymous Coward | more than 6 years ago | (#19564101)

"Vir means man. Its plural is viri"

Thus, Agent Smith is proved correct.

Re: Viruses/Viri/Virii (1)

infaustus (936456) | more than 6 years ago | (#19561315)

Virus is a latin word (originally just meaning slime or ooze, but I've seen latin-english dictionaries list it as virus-virus.) Viri does mean men (virus does not mean man) but it also is the correct plural of virus.

Re: Viruses/Viri/Virii (1)

AlecC (512609) | more than 6 years ago | (#19564067)

Actually, it is a Latin word, meaning "slime". But since it is a collective noun, it probably does not have a plural, just as we rarely refer to "slimes". It is probably thiord declension, in which case the plural is virus, rather than first, which would give virii.

Re: Viruses/Viri/Virii (1)

Herby Sagues (925683) | more than 6 years ago | (#19561425)

THe fact that the language is evolving doesn't make any common distortion of the language right. Virii was not even right in Latin, so what would be the reason to create an irregular declination of a word without any reason other than trying to look cool?

Re: Viruses/Viri/Virii (1)

Lord of Hyphens (975895) | more than 6 years ago | (#19563875)

...so what would be the reason to create an irregular declination of a word without any reason other than trying to look cool?
Game.
Set.
Match.

Re: Viruses/Viri/Virii (1)

fbjon (692006) | more than 6 years ago | (#19561961)

No, but dictionaries on the other hand do have some authority. Also, I think someone in the industry is as likely to use 'virii' as they are to use 'M$' or 'filez', or some other lame thing like that.


Not to mention, the "language is evolving" argument doesn't mean that just any invented word is ok to use. Language evolves over time by itself, not because we're telling it to evolve.

Re: Viruses/Viri/Virii (1)

digitig (1056110) | more than 6 years ago | (#19562685)

Language evolves over time by itself, not because we're telling it to evolve.
Wow, clever language! How does it manage that, without the help of people to provide the mutation and selection? (BTW: is Esperanto the language of religious fundamentalists? It's Intelligently Designed!)

Re: Viruses/Viri/Virii (2, Interesting)

mrbluze (1034940) | more than 6 years ago | (#19561753)

Yes, viri/virii is incorrect (for now), but when the vast majority of us don't RTFA (or can't, due to the /. effect), you can hardly expect people to figure it out all on their own ;)

If we speak of groups of virus types (that is, a species), there are different forms used depending on whether we're speaking of a family, genus, etc. (if you read the full wikipaedia article, and if you studied it in uni):

  • Order: virales
  • Family: viridae
  • Subfamily: virinae
  • Genus & Species: virus

Now the individual virus is a virion, which probably has its own possible plurals, to make matters worse.

But viruses is the correct plural for English speakers, by convention, but I remember the virulogist (or virologist) speaking of viruses as viridae, since we usually distinguish them by their family, eg: herpes, pox, and so on.

Viri/Virii are wrong in any case (1)

nephridium (928664) | more than 6 years ago | (#19564247)

Virus derives from the Latin word for "venom" and has the neutral gender. The Latin plural -i only applies to masculine nouns of the o-declination. The proper plural for virus, if you'd want to use the Latin form, would be vira (though afaik there is no documented usage of the pural form), all neutral gender nouns have an -a (nominative) plural.

Re:Why do they never come right out and say... (1, Insightful)

WhatAmIDoingHere (742870) | more than 6 years ago | (#19563067)

How does using a different brand of computer make you a "douche"? I think it's the average mac user themselves who think that because they own a Mac they're superior. Actually, I think they thought that before they even got the Mac. I'm a recent switcher, 6 months now, and I don't think I'm any more of a douche than I was before. I'm not a hippy and I'm not artistic, I just like it because it's something I've never used before and it does just about everything I need to do and it's more stable/easier to use than Windows.

And if nobody gave a shit about Macs, why does Apple have a bigger market share than Toshiba and currently has the same size market share as Gateway? Oh, and Apple's market share is growing every day much faster than either of those two companies.


But maybe you're just a troll.

Re:Why do they never come right out and say... (1)

solitas (916005) | more than 6 years ago | (#19563507)

It ain't the platform - it's the application: if you want to use an app that "lifts its skirts" for every intrusion probe that comes along then that's YOUR business.

Can we help it if our apps are just better written than the ones you choose to use? :)

Because it's all... (0, Flamebait)

trippeh (1097403) | more than 6 years ago | (#19560403)

...lies.

Beslides, I'm not technically savvy enough to use Linux and I dislike having to find an emulator for my favourite games, or run a screen-long line of code to start up my various crapplications. Sure, that might have changed since I last tried an OSOS, but my first experience wasn't too pleasant and I'm not anxious to repeat it. The operating system itself wasn't the problem. It was the forums. Too much "stfu MSn00b" and not enough actual help.

Insular sods...

Re:Because it's all... (0, Troll)

hdparm (575302) | more than 6 years ago | (#19560631)

STFU MSn00b

Re:Because it's all... (0)

Anonymous Coward | more than 6 years ago | (#19562875)

and modded troll!

Nobody has a sense of humor here anymore

Re:Because it's all... (1)

eat here_get gas (907110) | more than 6 years ago | (#19563899)

Evidently today is GayMacFanboi Day...this guy gets modded "flamebait' because he showed how using a MAC wasn't good for him? And he wasn't even finding fault with the OS, just the bullshit that goes with making the "crapplications" function. But everyone that flames M$ gets modded up....this IS a truly weird place.

my Karma is low for a reason,
up yours.

Re:Why do they never come right out and say... (4, Insightful)

Daychilde (744181) | more than 6 years ago | (#19560833)

Insightful my ass...

The day your favorite OS dominates the market, it'll be pwned, don't you worry. And I say this as 1) a Firefox fan, hoping that it never gets to be the majority browser for precisely that reason, and 2) a fan of all the OS's. I use Windows for my desktops, Linux for my servers, and Mac sometimes to play. They all have fans, and I don't feel the need to belittle any of them to make one of the others look better. It doesn't work that way.

Hope I don't get modded down - I'm not so much flaming as ANTI-trolling if you catch what I"m trying to say. heh. :P

Re:Why do they never come right out and say... (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#19560951)

Wow, you're a fag, "I like them all the same", "can I just bet that they all have a good time"?

Re:Why do they never come right out and say... (5, Insightful)

Anonymous Coward | more than 6 years ago | (#19560957)

"The day your favorite OS dominates the market, it'll be pwned, don't you worry."

If market share is any indication to being pwned; then why isn't Apache attacked more that IIS? According to Netcraft Apache has 53.76% of the market compared to MS: 31.83%

And I say this as 1) a Firefox fan, hoping that it never gets to be the majority browser for precisely that reason, and

I personally only want FF have enough of the market; just enough to make companies follow the web standards: IE not catering to only one browser. Actually, the same applies to ODF; just enough to make companies not require a specific Office Suite.

"2) a fan of all the OS's. I use Windows for my desktops, Linux for my servers, and Mac sometimes to play."
Use what ever works for you.

Re:Why do they never come right out and say... (1)

cyphercell (843398) | more than 6 years ago | (#19561389)

funny how you remove one player and suddenly security comes from competition rather than third party patch professionals.

Re:Why do they never come right out and say... (1)

Herby Sagues (925683) | more than 6 years ago | (#19561391)

> If market share is any indication to being pwned; then why isn't Apache attacked more that IIS? Actually it is. Look into any defacement reporting site (such as zone-h.org) and look at the numbers. They vary every day, but ion average about 60% of the defacements are for linux boxes. So there you have.

Defacements.... (3, Informative)

DrYak (748999) | more than 6 years ago | (#19562297)

Look into any defacement reporting site (such as zone-h.org) and look at the numbers. They vary every day, but ion average about 60% of the defacements are for linux boxes. So there you have.


What the parent poster talked about was the very low amount of Apache-targeting viruses and exploits compared to those targeting IIS. Apache is the most widespread server software, but IIS is the one that gets most viruses.

And most of the time this kind of vector is used as described in current article : as a way to get control on machine to distribute malware and/or be used in a botnet.

Whereas, what you speak about - defacement - is done in most of the case, by stupid script kiddies who just use some random tool to exploits bugs (either remote execution or SQL injections) found in common PHP script (forum engines, etc.), it is mostly server independent. Apache or IIS doesn't matter as long as poor script code is present with known vulnerability. Therefore, you're very likely to find that the defacement frequence follows closely the market share of the servers.

Most of the time, the script kiddie just put "I am teh 1337 r0xx0rs !" in the front page. You can't do much with a compromised script (you can't start a IRC server, put a zombie bot, a full mail server for spitting spam or use it as a starting point to infect other servers in the vicinity).

Re:Why do they never come right out and say... (2, Informative)

und0 (928711) | more than 6 years ago | (#19562305)

Defacements are usually done exploiting poor coded PHP applications, not exploiting Apache bugs, FWIK...

Re:Why do they never come right out and say... (4, Informative)

1u3hr (530656) | more than 6 years ago | (#19561117)

Regardless of scoring points in the OS/browser pissing competitions, I'd just like to know what OS and browser are vulnerable, so I know whether I personally have to worry about this.

The summary and linked articles don't even say that. Only Panda's MPack report, a dozen pages in, starts to list the actual vulnerabilities targetted. Which are IE, WMP and one Opera bug. However, the malware is actually modular in which new vulnerabilities can be plugged in, so this isn't static, and they say new versions come out about once a month.

Nevertheless, unless the WMP vulnerability works on multiple browsers, it's just Windows IE (duh) and Opera. No mention of Linux, Mac or Firefox I saw.

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19561347)

Firefox and Opera was both in the report but the bug they used was in the plugin MS mediaplayer.

Re:Why do they never come right out and say... (3, Informative)

bl8n8r (649187) | more than 6 years ago | (#19563243)

Looks like Windows*. No really. Yes again.

" 1) A Trojanised WMF File (Downloader)
    2) ActiveX/OCX File (dropper)
    The downloaded malware, when executed, installs
    1) A rootkit "

Most of the world is in denial about the whole security issue surrounding
Windows. Even some of the postage on /. is quite alarming. People don't
*want* to know, that's why they don't post it.

[*] - http://blog.trendmicro.com/italian-job-vs-italian- bizness/ [trendmicro.com]

Re:Why do they never come right out and say... (1, Funny)

Anonymous Coward | more than 6 years ago | (#19561265)

Let's just hope that Apache never becomes dominant in the server section so the same doesn't happen to it.

Re:Why do they never come right out and say... (1)

mjwx (966435) | more than 6 years ago | (#19562049)

Well I'm afraid it doesn't work that way

MS is the most attacked company because of two reasons, first they have no ethics and don't think twice about screwing the consumer by lockin and predatory licensing schemes. The second reason is that all MS formats are MS formats, there are no other products that effectively use those formats (lockin, this relates back to point number one). If OSS (Linux) reaches MS levels of market share it will not suffer the same amount of attacks, or even half as many. This is because of two main reasons, the first being a superior security model the second being open formats. What open formats will allow is multiple different operating systems to utilize the same files etc. MS is so widely attacked not because every 9 out of 10 computers are running windows but because they are all running the same version of windows, one virus could effect 90% of the worlds computers. Due to diversity this is less likely to happen to *nix, or even Linux specifically.

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19562917)

+5 Insightful my ass...

The Microsoft astroturf contingent is out in force today!

pwn this... (0)

Anonymous Coward | more than 6 years ago | (#19563647)

Getting the attention of hackers by being big doesn't make you more vulnerable than you already were. If it was as easy to exploit Mac and Linux as it is Windows, there'd be viruses galore for them too.

Most Microsoft "bugs" are in the core design. They can't really fix those, because they consider them features.
Even if they started over the employees that came up with Autorun, ActiveX, DirectShow... they'd just ruin everything again.

A company which survives by imitating some good ideas will have mostly bad ones.

Re:Why do they never come right out and say... (4, Insightful)

Anonymous Coward | more than 6 years ago | (#19560879)

Disclaimer: I am neither a Windows fan nor an Mac hater. I use Windows *nix almost equally.

Everytime some vulnerability is found, someone shouts about not using Windows, especially these Apple lovers. Come on guys, can we stop this? These so called malwares target novice users, not Slashdot users. Tell me a single alternative your mom can use and I will take it. The so called alternatives are either too_expensive (suggest your mom to shell out 2K on Mac just_to_get_on_internet) or too_not_userfriendly. Why not stop beating the drum on Windows?

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19561195)

Okay, why don't you stop using that old excuse about Linux not being user-friendly. My mom and my step-dad both use Linux everyday and are incredibly inept at using computers. The biggest thing for them was just getting them to swap in the first place, once they did swap they found everything to be incredibly stable and easy.

Re:Why do they never come right out and say... (1)

compro01 (777531) | more than 6 years ago | (#19562205)

i agree that modern Linux distros (Ubuntu in particular) are very easy to use for day-to-day use, but it can get ugly in a big hurry when things go wrong.

granted, same thing happens with Windows, but it seems to happen more severely with Linux in my experience. i seemingly need to make use of the command line much more often in Linux problem solving than i do in windows, and while that is no problem for me, it's extremely intimidating to most users.

Re:Why do they never come right out and say... (1, Insightful)

fucksl4shd0t (630000) | more than 6 years ago | (#19562257)

Let's see, users are asked to use a commandline and they say "I've got no idea, how much do you charge?"

--compared to--

After a long series of condescending dialogs over what was otherwise a minor problem, the user has now unwittingly completely trashed his system. She's on the edge of a nervous breakdown and doesn't know who to trust, because her 4 calls to Microsoft tech support led her down 8 different blind alleys, and her friends have all told her to just reload, but make a backup first, and she's thinking "wtf do you mean, reload? And how am I supposed to do a backup?"

Here in the linux world, I think it's perfectly ok to offer only an advanced UI for a task that expects the user performing it to have the necessary skills to do it, or the necessary time to learn the skills. The alternative we've all faced already, some friend/relative shows us a computer that's needlessly fucked because the OS lied to them, by both calling them an idiot and telling them it would fix it for them.

Yes, for all tasks that a user reasonably is expected to perform, Linux does well, imo better than Windows. For more advanced sysadmin type stuff, it also does very well by presenting the user with the simple choice: learn how to do the task or find someone who knows how to do the task. Use Linux and you'll never need your prozac again.

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19561307)

If you really want an affordable, no virus machine (so far) for your mother, Apple does sell a headless Mac for 600 bucks. Single core Intel, light on memory, so-so graphics. But it's not at all shabby for e-mail, ripping some CD's, maybe touch up and photo albums from her digital camera.

Score a copy of Windows, install via Boot Camp and she can use any existing programs that she has. Only please to uninstall IE 7 so the Windows side never sees the internet.

Re:Why do they never come right out and say... (1)

the_womble (580291) | more than 6 years ago | (#19561431)

Tell me a single alternative your mom can use
My father uses Mandriva. So does my wife. My four year old daughter currently uses Kubuntu.


None of them could install Linux for themselves, but they have no problems using it.

shell out 2K on Mac just_to_get_on_internet

1) A bottom of the range Mac costs nothing like that
2) Install Linux, say "this icon starts the web browser, this icon starts the email program". What is so difficult about that?

Re:Why do they never come right out and say... (1)

walt-sjc (145127) | more than 6 years ago | (#19563499)

Indeed. iMac's start at $999, mac Mini $599. iMacs are ready to go, mac mini needs a mouse, keyboard, display, which you can probably use your old PC ones. IMHO the iMac is a better deal (built in iSight too.) Claiming it costs $2K though is disingenuous - especially since that is twice what it really costs. While you can buy a cheaper dell, when you start comparing specs the Macs are quite competitive.

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19561789)

I agree. If I was a malware writer, I would not spend my time on *nix, because *nix users are unlikely to be caught. Mac? Too freaking small user base to waste my time! As simple as that. If more people switch to these system, there will be a time when it will make sense to target them too. Remember there was a time when there was no exploit for Firefox. This very one exploit targets Firefox too. Even Opera too.

Re:Why do they never come right out and say... (0)

Anonymous Coward | more than 6 years ago | (#19562953)

Slashdot is owned by SourceForge (so is Linux.com), right? There is no such thing as "responsible, objective journalism" when the editors & owners have interests to protect, vs. the competition (Microsoft)!

Thank goodness the poster of this thread (by Anonymous Coward on Tuesday June 19, @12:16AM (#19560879)) to whom I am responding understands this much, & could see through it.

Unfortunately?

Well, most of the world is populated by sheep that can't even read their credit card bills or others obligation's reports, to understand when they are being hoodwinked, and they just pay the bill anyhow without perusing it carefully, line-by-line, to catch it (or in this case, "read between the lines" here, & understand this site's motivations).

The ownership here knows sheep are easy to herd, and even if you expose them for something? Something bigger/badder will come along the next day, and blow it away, and the sheep will forget about it in a day or two.

Plus, imo, they also understand that 'controversy is good' and it pays their bills when people fight over Windows vs. Linux (vs. MacOS X etc. et al). It gets views up and this is all they are truly concerned over imo, like any soulless money grubbing freak is.

Newsflash - money is not going to make you a bigger man with a bigger penis boys.

Re:Why do they never come right out and say... (1)

pakar (813627) | more than 6 years ago | (#19564073)

Simple... Do what i did for my dad.

- Install whatever distribution you prefer
- Install fluxbox
- Configure fluxbox so you have a static menu on the top left with the applications that they might want to run
- Install Firefox
- Install Thunderbird ( added wmpop3 so he don't have to start the mail client to see if he has any mails )
- Install Openoffice
- Install GPhoto2

My dad has a keyboard with a few multifunction-keys on the top that i mapped to the different workspaces. It seems like he has problems with understanding the concept of having multiple windows on the same workspace and lots easier to just start the different applications on their predetermined workspaces and just press the "web-button" or the "mail-button"

Even have some simple scripts for him so he can just select album(s) from GPhoto and the system records it to a CD/DVD that he then can play in his DVD-player..

And maybe install a VNC-server that you can access via a SSH tunnel and your are done...

It's perfect for him... And why did i do this?? Well, he complained that Windows was hard and messy to use! And this was of course his first computer ever. (about 1½ year ago :)

What i'm getting irritated on is that people without real experience with any Linux distribution chooses the most difficult ones to use. Shure you are good on Windows, but that does not automatically give you experience on *nix systems.
And then ofcourse complain about how hard the system is to use.. I would say, if you don't know by heart how to manually compile and use a new kernel from kernel.org on your system you should be running one of the simpler distributions.. You still have all the options of changing the configuration there, but you have alot of automatic things too until you know how to do that manually too.

I have been running different distributions on my private system for about 12-13 years now and working with it for about 10 years, and every single say something new comes up, so don't pick the hardest one to start with, go with one of the simpler where things are automated until you feel a bit more shure about how it works, then maybe try another distribution if you are not satisfied with the simple one.

Super Mario Malware! (1)

feedmetrolls (1108119) | more than 6 years ago | (#19560353)

That's all the insight I can come up with.

Re:Super Mario Malware! (0, Offtopic)

GFree (853379) | more than 6 years ago | (#19560367)

You know Italy is doing well for its cultural representation when "Super Mario" is the first thing that springs to mind.

Re:Super Mario Malware! (0, Offtopic)

beav007 (746004) | more than 6 years ago | (#19560411)

Really? For me it's hairy women. And yes, I'd prefer that it didn't spring to mind. It just does.

Look! A distraction! *runs*

Re:Super Mario Malware! (0)

Anonymous Coward | more than 6 years ago | (#19560557)

is your username refering to beaver? :P

Re:Super Mario Malware! (1)

beav007 (746004) | more than 6 years ago | (#19560607)

In a now apparent unfortunate turn of events for me, yes it is. It comes, however, from having that nickname in school due to my buck teeth.

I wish they'd count "servers" and not "sites" (5, Interesting)

Anonymous Coward | more than 6 years ago | (#19560373)

This malware probably just affected a single DreamHost shared server, thus bringing down 10,000+ sites at once.

But this method of artificial number inflating is to be expected from an industry trying to promote their anti-malware, anti-virus, anti-spyware, anti-trojan, anti-anti-virus, anti-rootkit products. Anyone actually requiring these craplets to be installed on their dedicated servers have a much larger problem between the keyboard and the monitor to worry about.

Re:I wish they'd count "servers" and not "sites" (2, Insightful)

siddesu (698447) | more than 6 years ago | (#19560471)

you're right to an extent, but still, if you are a site owner, and if your site is making money for you (or if you are a site user, and are delivering benefits from the said site) little would you care if you're co-hosted or not. the days when putting up a site meant l33t skillz and buying a server seem long gone. the fact that sites are hosted on one server (and it may be a big server) doesn't make the problem smaller to the owners and the users.

and, incidentally, imho software companies should be liable for trouble created by their software as the hosting companies are.

Re:I wish they'd count "servers" and not "sites" (2, Insightful)

Anonymous Coward | more than 6 years ago | (#19560793)

and, incidentally, imho software companies should be liable for trouble created by their software as the hosting companies are.

Never will happen.

The software vendors cannot control what 3rd party software run with their software -- not even a pure 'monoculture' PC from the OS up.

Hence the usual longwinded boilerplate EULAs that REALLY only say 3 things:

1) Do redistribute our software.
2) Do not reverse engineer our software.
3) This software is "AS IS". Use it at your own risk. We are not responsible for anything that happens to your compuer when you use our software.

Re:I wish they'd count "servers" and not "sites" (0)

Anonymous Coward | more than 6 years ago | (#19560939)

Oh yes, the EULAs that

(1) aren't valid, because they weren't disclosed before the purchase
(2) can't override the implicit warranty of fitness for the purpose for which sold

Probably the software companies will be found liable only in cases of provable malice, not for negligence.

But IANAL, so what do I know?

Re:I wish they'd count "servers" and not "sites" (1)

Herby Sagues (925683) | more than 6 years ago | (#19561457)

You might be right about the second point, but where does it say that the product was sold "to resist attacks by malicious third parties"? Are car manufacturers liable when a well equipped specialist thief is able to steal a car? If a product is sold as absolutely crook resistant, then the company should be liable. AFAIK neither Microsoft nor any other software manufacturer promises that.

Re:I wish they'd count "servers" and not "sites" (0)

Anonymous Coward | more than 6 years ago | (#19561343)

BS pure and simple. Car companies can't control what resellers or customers do with their cars, but you don't see EULAs removing product liability attached to cars. It is just the fact that the economy has been reliant on software for a short time, and the fact that the company that controls most of what is causing trouble is too big that things are going teh way they are.

Re:I wish they'd count "servers" and not "sites" (4, Insightful)

tinkertim (918832) | more than 6 years ago | (#19561875)

and, incidentally, imho software companies should be liable for trouble created by their software as the hosting companies are.

There are many web hosting companies and some of them negate their responsibility to Internet users at large.

The web hosting industry does not get much attention from free software developers. This is broadly because they want to insist that anything they spend money on develping not be usable by their competition. As such, no company (under the terms of the GPL) may make any developer sign any kind of non disclosure agreement for the purposes of receiving GPL code.

The web hosting industry is stuck in a rut of its own design. It uses software that it can't modify to meet its real security needs because nothing exists free that has all of the working features that their customers demand.

This is the problem, this will continue to be the problem for quite some time. Even if a free control panel and billing system were realsed that they find suitable it would only be after perhaps a couple years of development and testing.

Sad, but true. The industry is making us all a victim of its success. It sells the use of GNU/Linux computers pocketing all profits and only giving back to companies that produce software that is not free.. totally against the tit-for-tat that made it such a lucrative market to begin with.

You're right, but you left out some stuff. :) I'm part of that industry, but only one of very few people who speak out against the practice and remain able to eat and pay bills.

Re:I wish they'd count "servers" and not "sites" (5, Informative)

antic (29198) | more than 6 years ago | (#19561111)

A big, usually decent hosting company in the US that I use was getting done over by this - I had 10-20 sites infiltrated over a period of a few weeks, in 2-3 waves using two slightly different techniques. The host denied any responsibility or knowledge, saying that poor FTP passwords were the entry point. My computer was not the issue as those sites hacked were all on this host - no sites on any of the other 5 or more hosts I use were impacted, regardless of the strength of their passwords.

Trivial passwords (single English word of five characters) were guessed as well as slightly more complicated ones (non-English words, eight characters, random numbers inserted).

It appeared to me that were the host NOT the problem, that bots might have been guessing the passwords through brute force? I searched the net seeing if I could find more information about these attacks, but there wasn't much out there, especially given that there wasn't much to search on besides the fact that they used an IFRAME or JavaScript DeCode function, and a probably random set of IP addresses.

Anyone know more about it all?

Re:I wish they'd count "servers" and not "sites" (0)

Anonymous Coward | more than 6 years ago | (#19561567)

Anyone know more about it all?
If it is shared hosting then it is probably the actual server which has been rooted and it is the hosting companies problem (which they'll deny as usual).

Even with dedicated hosting, quite often the hosting company has their own backdoor/password into the system. If a hacker breaks into any single server with that hosting company, they can get the master password and login to all the other servers (including yours). Or hackers could even hack the computers of the system administrators within the hosting company. They'll never acknowledge or even investigate this claim if you ask them about it, so it is always just safer to lock them out and do everything yourself. Another angle of attack is via network sniffing on the hosting companies end, done by a compromised server somewhere within their data center. Cheap hosting providers won't give you an individual VLAN for each server, which is one essential way to help ensure you're safe from hackers.

Or maybe you were running the same piece of vulnerable software or script on each site?

Re:I wish they'd count "servers" and not "sites" (1)

antic (29198) | more than 6 years ago | (#19562443)

Some sites used scripting, MySQL, etc, most were completely dead-boring static HTML.

If it wasn't a brute force guess of the passwords, then I think you might be right about the shared server being infiltrated. If that is the case, then it's such a shame that one can get stuck in the dark because the host is too embarrassed to reveal the truth - e.g., waste days trying to research possible threats and causes.

Re:I wish they'd count "servers" and not "sites" (1)

ricotest (807136) | more than 6 years ago | (#19562571)

If it was brute force, the host is still at fault - virtually every provider out there has a login attempt limit for FTP connections, and you'd think thousands upon thousands of failed logins would show up on their logs.

Re:I wish they'd count "servers" and not "sites" (1)

antic (29198) | more than 6 years ago | (#19563235)

When I suggested that that should be happening, they didn't really have any response - surely if they did, they would've mentioned it?

So, if that were the case and it took a certain level of effort to get past low-medium level passwords, then realistically it's just a matter of time before tougher (12-15 randomised characters) passwords get done?

Re:I wish they'd count "servers" and not "sites" (0)

Anonymous Coward | more than 6 years ago | (#19564041)

it's just a matter of time before tougher (12-15 randomised characters) passwords get done?

No, because the problem is exponential.

12 random alphabetic (let's say all upper-case) characters gives you 26^12 = 95,428,956,661,682,176 passwords. If you can check a million a second, operating 24/7, it will take 9.543 * 10^10 seconds to check them all, or about 3023 years.

You'll probably find your password sometime before that, but it will most likely take many, many years.

Throw in lower-case letters, numbers, and symbols and it gets much harder.

Re:I wish they'd count "servers" and not "sites" (1)

Stinky Cheese Man (548499) | more than 6 years ago | (#19563767)

Anyone know more about it all?

It would help if you actually identified the hosting company. One "big, usually decent hosting company" that I am familiar with, that hosts about 3,000 sites per server, had at one time a password-hash file that was readable by anyone with an account on the server. All you had to do was download the file and run a password cracker on it and you could recover a large number of user passwords. I warned them about this 10 years ago. They thanked me and did nothing. It may still be this way.

Aruba (0)

Anonymous Coward | more than 6 years ago | (#19561989)

From what I could read in the italian newsgroups, attack started june 16 with the iframe added on "home pages". One user reported that a template inside a DB was modified, but news can't be confirmed.

The hoster is "Aruba", a really big hoster in Italy, famous for their low prices. A couple of weeks ago another italian "Hosting Solutions" was hacked. It seems that both hoster are using cpanel as a client frontend.

In both cases hosters were really bad at handling the situation. They both blamed clients about using weak password or that the password were stealed from their PCs.... can't be for an event so big....

After 4 days from the start of the attack (and several weeks after the similar attack at hosting solutions), we have no informations about HOW they succeded hacking the servers ! And THIS IS BAD ! We don't know if we have to blame cpanel, ftp server, windows or a particular site that using a site feature (sql ? cgi ?) allowed privilege escalation....

Francesco
Roma, Italy

Re:I wish they'd count "servers" and not "sites" (0)

Anonymous Coward | more than 6 years ago | (#19562029)

It wasn't serving Digg, was it?

Re:I wish they'd count "servers" and not "sites" (3, Interesting)

justinlee37 (993373) | more than 6 years ago | (#19562313)

between the keyboard and the monitor to worry about.

Did you mean between the keyboard and the chair? Because all I see between my keyboard and my monitor is a desk with a dirty shot glass, a lighter, a knife, a case screw, two dimes, two empty cups of hot sauce, an open bottle of safeway-brand "personal lubricating liquid", and a bag of grass ...

So you may be able to understand how I'm totally lost here.

Mafia spam? (5, Funny)

Tablizer (95088) | more than 6 years ago | (#19560995)

As a sign of this, I just got a spam that insisted I purchase a lower mortgage, along with a photo of a horse head.
     

Re:Mafia spam? (1)

Afecks (899057) | more than 6 years ago | (#19561017)

As a sign of this, I just got a spam that insisted I purchase a lower mortgage, along with a photo of a horse head.

Was it one of these? [kropserkel.com]

It's all Microsoft vulnerabiltiies (5, Informative)

Animats (122034) | more than 6 years ago | (#19561239)

Note that Trend Micro never uses the word "Microsoft". That's deceptive. How does Microsoft manage that? This attack depends entirely on vulnerabilities in Internet Explorer and Microsoft Media Player. It does try to attack Firefox and Opera browsers by sending them Windows Media files, but doesn't have a direct attack on either browser.

So:

  1. Use Firefox.
  2. Go to Tools->Options->Content->Manage File Types. Go down the list, and remove or change all entries that automatically invoke Microsoft applications. (Use OpenOffice for .doc, .xls, and .ppt, maybe QuickTime for video files.)

Re:It's all Microsoft vulnerabiltiies (1)

corsec67 (627446) | more than 6 years ago | (#19561439)

Note that Trend Micro never uses the word "Microsoft".

That is because to most people "computer" means something running Microsoft Windows. Saying that computers running Windows were involved would be like saying "the accident involved cars with internal combustion engines." That, and reporters don't really care about educating their readers, they just care about making the publication money.

And that is my bad attempt at an automotive analogy.

Re:It's all Microsoft vulnerabiltiies (5, Insightful)

weicco (645927) | more than 6 years ago | (#19561611)

Even simplier:

  1. Run Windows Update

Re:It's all Microsoft vulnerabiltiies (0, Troll)

wellingj (1030460) | more than 6 years ago | (#19562163)

What about:
  1. Run Ubuntu Live Install.
That should take care of it once and for all...

Re:It's all Microsoft vulnerabiltiies (1)

TheRaven64 (641858) | more than 6 years ago | (#19563421)

I booted my Thinkpad into Windows the other day, and it did this automatically, and then told me I needed to reboot to complete the installation.

I'm still trying to figure out how it managed it without being connected to a network...

Re:It's all Microsoft vulnerabiltiies (1)

FudRucker (866063) | more than 6 years ago | (#19563161)

in light of microsoft's inability to build a secure system & application and users refusal to switch to a more secure system (BSD,Linux) is about the same as refusing to get off the rail-road tracks knowing a freight-train is about to run you over...

What web servers are vulnerable? (1)

bailey86 (1049254) | more than 6 years ago | (#19562137)

What web servers are vulnerable? Been looking around but can't see anywhere anything about the type of web server being infected.

Tiscali? (2, Informative)

flokemon (578389) | more than 6 years ago | (#19562343)

From the article:
"Apparently, most of these sites are hosted on one of the largest Web hoster/provider in Italy."

Why would I not be surprised if Tiscali's webservers were somehow to blame?...

Re:Tiscali? (0)

Anonymous Coward | more than 6 years ago | (#19562427)

The hosting provider appears to be Aruba.

Beware of the Panda (0)

Anonymous Coward | more than 6 years ago | (#19563297)

While the Panda Software report is probably legit, I'd advise everybody here against downloading and using *any* software and/or service from them. Panda Software has a history of spamming and is tied to the infamous cult of Scientology. More info here [wikipedia.org] .

Is this the... (1)

ByteofK (952750) | more than 6 years ago | (#19563439)

...mojo-rific Italian Job with Quincy Jones producing it, or the lame up-to-date any-excuse-to-sell-a-video-game version?

After the title... (2, Funny)

Comboman (895500) | more than 6 years ago | (#19563459)

...I was hoping for a story about a malware attack that involved the use of Michael Caine and numerous Minis.

A malware question to the comunity (1)

Koyaanisqatsi (581196) | more than 6 years ago | (#19563571)

Not completely on-topic but hey, it does not warrant a full "ask slashdot" and I've been struggling with this for a couple of days now ...

I've been hit with win32.Perlovga.A on a secondary computer through an infected USB key. That machine had no anti-virus and autorun was at that time enabled (stupid). This particular crapware saves two EXE files (copy.exe and host.exe) and an autorun.inf that executes copy.exe to the root of each volume. When the infected USB key was plugged-in, it loaded the mallware.

I removed all instances of the mallware itself, all is clean and nice, except for:

There seems to be some rootkit left behind because if I extract those two EXE files from where I saved them, they don't show-up in the filesystem unless I boot in safe mode, although nothing gets loaded in memory at this point.

Rootkit Revealer does not show anything suspicious, and AutoRuns shows way too much information and nothing that strikes me as odd.

Anyone has more experience with this one? I will really like to understand what it had done ...

Cheers!
k

A coup, by any method, is still a coup... (-1, Offtopic)

OldHawk777 (19923) | more than 6 years ago | (#19563693)

This (in the past) was called a peaceful banana republic coup, ... when a few privileged greedy people conspired to subversively/overtly topple/overthrow their populist democratic government for their special greedy, military, religious... interest.

In the USA, there was a time that this was called TREASON!

The old gray (US) dame, just ain't what she use to be, work her to death daily, put her away wet, and buy/steal the next one another day.

VOTE THEY ALL OUT ALWAYS, or hang'em for treason, the entertaining spectacle will be of great interest and attendance for US.

Don't worry everything is okay with US, and I am crazy, but smiling and laughing all the way to the bank (stock market).

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...