We believe we may be infected with malware | Hacker News Reader

We believe we may be infected with malware

isc.org

66 pointsmarcopolis27 comments

Disclosure is great and all, but.. which malware?

I searched a few of the *-announce lists and didn't find anything obvious. Is there a discussion somewhere that I'm missing?

http://www.cyphort.com/isc-org-infected/

paragraph 2: > Angler Exploit Kit

Thank you.

Technical Details: http://www.cyphort.com/isc-org-infected/

Based on this article, it appears that the exploit is something that takes advantage of IE / Flash / Silverlight. Does this mean if you run Firefox with Flash disabled and no Silverlight, you have nothing to worry about? In any case, if you had accessed the site recently, then it is probably prudent to check just in case, but still, I'm curious if anyone who knows more about the Angler Exploit Kit can explain.

JavaScript off will also quite effectively prevent this exploit (and many others), even in IE.

(I've been slowly converting people to use JS whitelists, with mixed results. Several times I've accidentally linked someone to an infected site, which had no effect on my system.)

Until this site is restored, you can download your ISC software from our ftp site.

How do we know the ftp site is clean?

The attack was directed at their WordPress installation[1], I'd presume they either host it separately or have verified it's clean.

1: http://www.cyphort.com/isc-org-infected/

It's ftp, not http. You cannot serve scripts over ftp, so unless there is a completely seperate exploit for ftp clients out there it should remain unaffected. Note that most browsers include an ftp client which is why you are able to browse it.

It's possible the binaries you download may have been modified, but I assume digital signatures are available.

The signatures are available but they are distributed through the same channel as the binaries. If the one was modified it stands to reason that the other has been too.

That only works for hashes. Signatures are produced by a private key which will not be available anywhere, so they can be verified by the public key which is already know.

Malware doesn't imply a script; I would worry about malware on the server itself running in userland.

Great idea to link to a potentially infected site. "Please scan any machine that has accessed this site recently for malware." OK, thanks, now I have to scan for malware.

The current page is clean.

'view source'.

Every site you visit is a potentially infected site, this one right now is probably one of the safer ones.

That said it contains a surprising amount of cruft for such a simple homepage.

Looks like it was thrown together with WINWORD.

The source says this temp page is made by Microsfot Word, i am pretty sure there is a clue here but i can't sniff it, and i am being serious.

I thought it was the Internet Storm Center at first, which was going to blow my mind.

Please explain how "this is a WordPress issue"

Given that WordPress runs over 20% of the internet, it would be prudent to elaborate.

WordPress is a large and soft target, security-wise, and the malware targeting it has become fairly sophisticated. Note both "large" and "soft" are important, which is why I said both.

If you are implying that you're going to try to claim that WordPress is not a large and soft target, all I can do is really strongly recommend against dashing yourself against those rocks voluntarily. If you'd like some light evening reading, you can try browsing through: http://osvdb.org/search?search[vuln_title]=wordpress&search[...

Although check this search out: http://osvdb.org/search?search[vuln_title]=wordpress+-plugin...

And my filtering isn't that thorough, a number of results are still in plugins or themes.

My point is that the majority of WordPress problems are not actually WordPress problems but problems with the enormous set of third-party content produced for it. WordPress's security engineering is generally pretty good now, but the plugins are very much a mixed bag.

isc.org also has the DLV registry... should users be worried?

so basically,

uninstall adobe flash and silverlight and never use IE.

*I just uninstalled adobe flash and reader. Probably will never install it again. Adobe is the new Java Applet.

> uninstall adobe flash and silverlight and never use IE.

Alternatively turn on ActiveX Filtering [1] in IE, whitelist [2] any websites that you need to run ActiveX controls on, make sure your plug-ins are up-to-date and install IE11 if you haven't already.

According to the Cyphort article linked above:

> Cyphort Labs researchers are still in the process of analyzing the Silverlight and flash exploits which exploit a known IE vulnerability (CVE-2013-2551). Angler EK is known to perform file-less injection (memory-based malware where nothing is written to disk).

As you can tell from the CVE number, the exploit used by Angler EK is quite old and doesn't affect IE11 [3] or older versions of the browser that have installed the KB2829530 hotfix [4].

> Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.

[1] http://ie.microsoft.com/testdrive/browser/activexfiltering/a...

[2] http://withinwindows.com/blog/2011/02/10/short-manage-your-i...

[3] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2...

[4] https://technet.microsoft.com/library/security/ms13-037

Unfortunately, flash is still used everywhere. I have flash set to 'click to play' which seems like a good middle ground.

Take a look at Mozilla's Shumway [0], an engine to convert Flash to HTML5, so that you need not use Flash Player anymore. This should mitigate most (if not all) of Flash's vulnerabilities. Be aware it is undergoing active development and is not fully stable yet.

[0] http://mozilla.github.io/shumway

Friends don´t let friends run bind...

Reply on news.ycombinator.com