web analytics

We’re popular – but with the wrong people

Written By: - Date published: 2:25 pm, October 5th, 2008 - 10 comments
Categories: admin - Tags: , ,

Lynn PrenticeAfter a lot of work both by a few e-mails from people here and by the good services of some people on nz.comp (google seems to be a little behind on the messages) I finally found the link to the malware site that was attached itself to the site footer.

The material that it was trying to introduce to people reading the site may include various forms of backdoors. It would be adviseable to run a good virus scan on your system if you have read the site in the last couple of weeks. Corporate systems shouldn’t have had an issue because the site it was linking to has been a well known chinese malware site for a long time.

The anti-virus/malware scans missed it at the server because it was a new variant of an old problem (the same one I had in march), targeted specifically at wordpress sites using what is evidently is still a open vunerability. My own checking of the site missed it because it had managed to leave all of the file attributes of the file (size, times, etc) exactly the same as the origionals. My attempts to see what people were reporting had failed because it only emitted the malware link out periodically. A dump of the web page at the client side by Stephen Worthington allowed me to see exactly what it was doing.

The vunerability it was exploiting was meant to have been fixed in wordpress 2.5, however they seem to have found another vunerability. The downside of having open source software is that it is possible to read the code looking for holes. I’ve done some things to reduce possible problems, but I now have MD5 hash check of the files running periodically which will fix the problem if it happens again. I’ve also reported the details to wordpress and a couple of other sites.

But there are some very creative people out there writing this stuff, and evidently this site is popular with them.

Lynn

10 comments on “We’re popular – but with the wrong people”

  1. r0b 1

    Oh hurrah!

    if you have read the site in the last couple of weeks.

    Once or twice…

    So, do you have any idea as to what to look for (by way of backdoor payloads) on our systems? What files where?

    Is MacOS X affected?

  2. lprent 2

    Mostly what it did was to set a cookie on thestandard.org.nz with the name ‘yagh’. It then attempted to bring in links from a site in china. Which then branched off into other sites (about 15). It did it once and then stopped doing it – the code said that it only did it if the cookie wasn’t present.

    I have a log (on the nz.comp) of what it was trying to do in one instance – starts at gstats (dot) com. I’m not too sure exactly what in the hell it was doing (and I’m unwilling to go to the sites to find out).

    Most of them are probably just trying to raise the google rank. But it is a good bet that at least some of them tried to install something.

    I’ve never seen any of this going on. I got the cookie but got silent blocking on the rest. When I cleared the cookie and made the AV non-silent, then I got a series of malware site warnings.

  3. Draco T Bastard 3

    The downside of having open source software is that it is possible to read the code looking for holes.

    That’s also the upside. I suspect that there are more people reading the code who will be honest and report, and possibly fix, the vulnerability than will be people looking for a back door.

  4. Rex Widerstrom 4

    It hit me and I ran screaming (well, figuratively) away and ran various checks which came up with nothing. But I’ll do it again now I have some idea of what to look for.

    Thanks for your sterling efforts, Lynn. You really should have some sort of mask, cape, and maybe a lycra suit (I’m sure Michael Laws can spare one from his wardrobe).

    As an aside, I can understand spending time on creating these annoyances to gain something (e.g. a higher Google ranking, which = hits which, they hope, = money). But I’ve never got my head round the idiots who merely create destruction. I mean yes, we know Microsoft is the Evil Empire with buggy software and more holes than a pole dancer’s crotch piece. Unleashing yet another piece of malware isn’t telling us anything new :-/

  5. Emma 5

    Thank you Lyn.I was frightened as I thought I had been hit up the backdoor by some nasty thing.

  6. r0b 7

    (duplicate could be removed – ta)

    Mostly what it did was to set a cookie on thestandard.org.nz with the name ‘yagh’.

    Mine has ‘yahg’ so I’m guessing your typo above. Thanks, and let us know if anything crops up that we should be testing for / looking out for.

  7. Tara 8

    Treat it as a perverse compliment – we must be doing something right.

    MacOS X is based on a version of BDS Linux and should not be affected.

    Fine Hacking, Lynn ..

  8. r0b 9

    Yes (BSD Unix) that means we’re almost certainly safe, given that most malware targets the Windows monoculture, but you never know. I had a Mac virus once back in 1993, so anything’s possible, one day I might get another…

  9. Phil 10

    I was frightened as I thought I had been hit up the backdoor by some nasty thing.

    Giggity Giggity!!! Oh yeah…

    Quagmire is my hero

Recent Comments

Recent Posts

No feed items found.

  • Pacific partners work together to provide additional support to Australia
    The NZDF continues to support the Australian Defence Force (ADF) as it battles fires in Victoria and New South Wales, including by transporting Republic of Fiji Military engineers from Nadi to Australia, announced Defence Minister Ron Mark. On Saturday morning a NZDF Boeing 757 will depart New Zealand to uplift ...
    BeehiveBy beehive.govt.nz
    20 hours ago
  • Kaikōura $10.88 million boost in tourism & business
    The Provincial Growth Fund (PGF) is investing $10.88 million to boost business and tourism opportunities in Kaikōura, Parliamentary Undersecretary for Regional Economic Development, Fletcher Tabuteau announced today. As part of the Kaikōura Marina Development Programme, the following two projects will receive PGF funding: A $9.88 million investment to begin the ...
    BeehiveBy beehive.govt.nz
    22 hours ago
  • Govt accounts in surplus, debt remains low
    The Government’s books are in good shape with the accounts in surplus and expenses close to forecast, Finance Minister Grant Robertson says. The Treasury today released the Crown accounts for the five months to November. The operating balance before gains and losses (OBEGAL) was above forecast by $0.7 billion resulting ...
    BeehiveBy beehive.govt.nz
    1 day ago
  • Auckland focus for first Police graduation of 2020
    The number of Police on the Auckland frontline is increasing with the graduation today of a special locally-trained wing of new constables. Police Minister Stuart Nash says the graduation of eighteen officers from Recruit Wing 333-5 means that more than 1900 new Police have been deployed since the Coalition Government ...
    BeehiveBy beehive.govt.nz
    2 days ago
  • Wairarapa gets $7.11m PGF water boost
    The Provincial Growth Fund is putting $7.11 million into creating a sustainable water supply for Wairarapa, Parliamentary Under-Secretary for Regional Economic Development Fletcher Tabuteau announced today. The following two projects will receive Provincial Growth Fund (PGF) funding: A $7 million investment in Wairarapa Water Limited for the pre-construction development of ...
    BeehiveBy beehive.govt.nz
    3 days ago
  • Progress with new Police station in Mahia
    Community safety and crime prevention in the East Coast community of Mahia has moved forward with the opening of a new Police station to serve the growing coastal settlement. Police Minister Stuart Nash has officially opened the new station, which was relocated almost 20 kilometres along the coast from the nearby ...
    BeehiveBy beehive.govt.nz
    4 days ago
  • Plans to protect the future of whitebaiting announced
    With several native whitebait species in decline the Minister of Conservation Eugenie Sage has today released proposals to standardise and improve management of whitebait across New Zealand. “The need for action for a healthy whitebait fishery has never been greater,” Eugenie Sage said.  “Four of the six whitebait species are ...
    BeehiveBy beehive.govt.nz
    4 days ago
  • New resource for schools to increase awareness and understanding of climate change
    A new Ministry of Education resource available for schools in 2020 will increase awareness and understanding of climate change, Education Minister Chris Hipkins said today. “The resource, Climate Change – prepare today, live well tomorrow, will help students understand the effects of climate change at a local, national and global ...
    BeehiveBy beehive.govt.nz
    6 days ago
  • Getting more out of our most productive firms
    Finance Minister Grant Robertson has approved the terms of reference for an Inquiry into the economic contribution of New Zealand's frontier firms. Frontier firms are the most productive firms in the domestic economy within their own industry. “These firms are important as they diffuse new technologies and business practices into ...
    BeehiveBy beehive.govt.nz
    1 week ago
  • NZDF sends more support to Australia
    The New Zealand Defence Force (NZDF) is sending an Environmental Health Team, a Primary Health Care Team and a Chaplain to Australia, boosting New Zealand support for the Australian Defence Force (ADF) as it battles bush fires in Victoria and New South Wales, Defence Minister Ron Mark announced today. The ...
    BeehiveBy beehive.govt.nz
    1 week ago
  • New Zealand joins partners in calling for full investigation into air crash in Iran
    Acting Prime Minister and Minister of Foreign Affairs Rt Hon Winston Peters says that developments suggesting a surface-to-air missile is responsible for the downing of the Ukrainian International Airlines flight in Iran is disastrous news. “New Zealand offers its deepest sympathies to the families of the 176 victims. It is ...
    BeehiveBy beehive.govt.nz
    1 week ago
  • Staying connected to Australian agriculture
    Agriculture Minister, Damien O’Connor, says the Ministry for Primary Industries is continuing to stay connected to federal authorities in Australia as devastating fires affect the country.  “The Ministry is using an existing trans-Tasman forum for discussions on the agricultural impact of the fires and the future recovery phase,” says Damien ...
    BeehiveBy beehive.govt.nz
    1 week ago
  • Investment in schools – a commitment to communities
    Thousands of school-age children, their teachers and wider communities are benefiting from the Government’s multi-million dollar investment upgrading and renewing schools, Education Minister Chris Hipkins said today. “We want New Zealand to be the best place to be a child and that means learning in warm, comfortable and modern classrooms,” ...
    BeehiveBy beehive.govt.nz
    1 week ago
  • New Zealand Defence Force sends support to Australia
    Minister of Defence Ron Mark today announced New Zealand is sending three Royal New Zealand Air Force NH90 helicopters and crew, and two NZ Army Combat Engineer Sections as well as a command element to support the Australian Defence Force efforts in tackling the Australian fires.  The New Zealand Defence Force ...
    BeehiveBy beehive.govt.nz
    2 weeks ago
  • Better access to books for blind and low vision citizens on World Braille Day
    "Today is World Braille Day and I am delighted to announce that an international treaty giving blind and low vision New Zealanders access to books and literary works comes into force today,” Minister for Disability Issues Carmel Sepuloni announced today. “Today the Marrakesh Treaty and the associated amendments to the ...
    BeehiveBy beehive.govt.nz
    2 weeks ago
  • New Zealand to send further firefighter support to Australia
    The New Zealand Government is sending a further 22 firefighters to help fight the Australian fires. “The devastation caused by these fires is taking a substantial toll on our Australian neighbours and we will continue to do what we can to assist as they deal with this extremely dynamic, dangerous ...
    BeehiveBy beehive.govt.nz
    2 weeks ago
  • Reducing the cost of education
    Twenty-two more schools have opted into the Government’s policy of providing $150 per child to schools who don’t ask parents for donations– bringing the total number of schools in the policy to 1,585. The Ministry of Education has accepted late opt ins past the November 14 deadline from schools that ...
    BeehiveBy beehive.govt.nz
    2 weeks ago
  • Road deaths lower in 2019, but still more work to do
    “As we enter the new decade, my thoughts are with the families, friends and communities of the 353 people who lost their lives in road crashes last year. While the number of deaths is lower than in 2018 (377), this is still a staggering loss of life,” Duty Minister Iain ...
    BeehiveBy beehive.govt.nz
    2 weeks ago
  • PM congratulates New Year 2020 Honours recipients
    Prime Minister Jacinda Ardern has congratulated the diverse group of New Zealanders recognised for their contributions to the country and their communities in the New Year 2020 Honours List.   The list of 180 honours recipients includes three Dames and three Knights Companion of the New Zealand Order of Merit, ...
    BeehiveBy beehive.govt.nz
    3 weeks ago
  • Justice Minister congratulates first Māori Supreme Court judge on New Year’s Honour
    Justice Minister Andrew Little has congratulated The Honourable Justice Joe Williams for receiving a knighthood for services to the state. Sir Joe Williams has been appointed as a Knight Companion of the New Zealand Order of Merit in the New Year 2020 Honours List. “Sir Joe Williams has made an ...
    BeehiveBy beehive.govt.nz
    3 weeks ago
  • New Year honours for top sportspeople
    Twenty-one of New Zealand’s top sportspeople, coaches and leaders in the sporting community have been recognised in the New Year 2020 Honours List. The Silver Ferns coach Noeline Taurua has been made a Dame Companion and the former All Blacks Steve Hansen has been made a Knight Companion of the ...
    BeehiveBy beehive.govt.nz
    3 weeks ago
  • Leading architect of Zero Carbon Bill honoured
    It’s great to see ordinary New Zealanders doing extraordinary things, Minister for Climate Change James Shaw today said in response to the news that Lisa McLaren is included in the New Year 2020 Honours List for her exceptional work leading the campaign for the Zero Carbon Bill. Lisa McLaren was ...
    BeehiveBy beehive.govt.nz
    3 weeks ago
  • Social entrepreneurs and innovation leads Pacific contribution
    Minister for Pacific Peoples Aupito William Sio says the New Year 2020 Honours List highlights the valuable contribution Pacific social entrepreneurs and innovators make to New Zealand, the Pacific region and the world. “The standout common factor that underlines their contribution to Aotearoa is the value they place in their ...
    BeehiveBy beehive.govt.nz
    3 weeks ago
  • Service to birds and bush recognised in New Year Honours
    Decades of dedication to Aotearoa’s unique birds, landscapes, and native eels is recognised in the New Year 2020 Honours List said Minister of Conservation Eugenie Sage. “I’m delighted that the decades of dedication to conservation, and fantastic leadership in giving nature a helping hand is being acknowledged,” said Eugenie Sage. ...
    BeehiveBy beehive.govt.nz
    3 weeks ago
  • Closer Economic Partnership with Singapore comes into force on 1 January
    New Zealanders will start to see the benefits of the upgraded Closer Economic Partnership (CEP) with Singapore from 1 January 2020, when the agreement comes into force. Minister for Trade and Export Growth David Parker said the agreement would open more opportunities for New Zealand companies looking to do business with ...
    BeehiveBy beehive.govt.nz
    3 weeks ago