|
Written by Wei-Jing Zhu
|
|
|
|
Friday, 05 September 2008
How to navigate this and other websites safely!The use of Google Chrome alert us that our primary sites Tech-Spirits.com and Teen-Ventures.com have been attacked, attaching URL forwarders to sites named google-analytlcs or google-analitics, which are obviously fake sites.
Google Chrome analyzed the two fake google sites, and show that while they are potentially malicious, they currently do not do anything dangerous, but only forward to ad networks.
To browse safely, use Firefox, and use the add-on "NoScript". This allows you full control of which scripts (associated with various websites) you allow. The default setting is all that you need.
We also use the add-on "FireBug" to analyze the javascripts associated with the attack.
Online search shows that while many website owners face this problem, there are not too many people who knows how it is done.
The fact that only the primary sites, and not the subordinated sites (like ccc or hln) are affected, suggests that the attack is toward the web hosting services.
I look through the php codes of both the mambo and joomla cms, to find no obvious changes, suggest that the attack is highly skilled. Googling for the two sites show that the style of attack has been changing over time. I did notice that the php file permissions have been changed, suggesting that the attack took place sometime in the last 6 months.
I will need to write this problem to Slashdot, and have the social power to combat these cyber criminals by raising general awareness.
The solution: After using Chrome view source, which preserves spaces, it showed that the attack hides the javascript code inside my site's index.php file, by adding 1000 empty lines after my file, and then start the script line with 1000 spaces, thus putting it in a corner that most people will not notice even if they know something is wrong. It got me wondering for 2 evenings! Removing the bad lines clear everything up!
Only registered users can write comments.
Please login or register. Powered by AkoComment 1.0 beta 2! |
| Last Updated (
Friday, 05 September 2008 ) |
Home 
