I may have faults, but being wrong ain't one of them - Jimmy Hoffa
|
|
|
BBC music websites get hacked
THE BBC'S MUSIC WEBSITES have been hacked to stream malware using drive-by downloads for anyone browsing the infected webpages.
Hackers set the drive-by malware up at the BBC's 6 Music website and the BBC 1Xtra radio station website. Researchers at the insecurity outfit Websense found the exploits and put its report up on its security labs blog.
"The BBC - 6 Music Web site has been injected with a malicious iframe, as have areas of the BBC 1Xtra radio station Web site," an anonymous Websense insecurity researcher wrote.
Websense claims the injected iframe is at the bottom of the BBC 6 Music webpage and has been set up to automatically download some dodgy code from a .cc website. Apparently the hack is exactly the same on the BBC's 1Xtra website.
"If an unprotected user browsed to the site they would be faced with drive-by downloads, meaning that simply browsing to the page is enough to get infected with a malicious executable," Websense continued.
The malware was designed using a Pheonix Exploit kit and only 12 out of 43 of the top anti-virus packages found the exploit. Using Virus Total scan to see which products picked up the injected iframe, Websense showed that anti-virus scans from some outfits like Kaspersky, Symantec, PC Tools and Trend Micro picked up the hack.
However, other top name insecurity vendors like Sophos, McAfee and even Microsoft's anti-virus tools didn't register the hack at all. That is an appalling detection rate from both free and paid-for anti-virus kits and, as of yesterday, Websense reckoned the anti-virus toolkits were still vulnerable. µ
Share this:
Share
Whilst the "it's an MS problem" camp have a point, it's definitely possible to craft effective malware for OSX in particular, and people have:
http://www.computerworld.com/s/article/9138517/Hackers_pay_43_cents_per_hijacked_Mac
OSX is less secure than windows in some respects. It invariably falls first at pwn2own (usually via yet another Safari 0day), it lacks decent exploit mitigation defences like full ASLR, there have been several notable trojans installed via fake Photoshop cracks and video codecs (which users run believing the apple marketing lies that macs "can't get viruses"), and apple frequently take months to issue security patches for known exploits then don't fully publicise what they fix. "Jailbreaking" is a trivial and mainstream thing, but how many jailbreakers are aware what it actually is? It's gaining total control (root access) over their device by hacking it, using an exploit which a malicious site could have used instead, and for all they know possibly did ...
Linux has considerably better "front door" client-side security, with frequent updates, no monoculture to target and a system whereby you normally run verified code from repositories only, but if you can get in somehow then local privilege escalation exploits are relatively common.
It's an old argument, but also true: the main reason these OS' aren't targeted is because their market share is too low to bother with, given that it's so easy to botnet ten thousand windows boxes. As OSX market share increases and windows security improves that's slowly beginning to change, as noted above.
Before I get accused of being an MS shill, I've used Linux routinely in some form since SuSE 6.1, my NAS and shell account are freeBSD / netBSD respectively etcetera.
I was going to post what the two above said about 'and I consider it bad journalism to act like this is a general PC problem. It is NOT.'
Seems to me that reporters are thought the 5Ws early on yet time and time and time again, you can read articles about Stuxnet, Conflicker or any of the thousands of others virii without ever reading the word Microsoft Operating System.
Seriously, I dare you read on any of these well known events and try to find a mention of Microsoft.
Cmon... go on.
This is truly both amazing and scary
I concur with chips. This is really becoming a nuisance and I consider it bad journalism to act like this is a general PC problem. It is NOT. This problem is limited to Microsoft Operating Systems ONLY. Anyone running a secure Operating System like for example Apple's OSX, Red Hat Enterprise Linux, Fedora or FreeBSD would never have been at risk.
Please take some journalistic responsibility and in the future be more clear and truthful about this.
When a car, make X & model Y, can loose a wheel at speeds above 35km/h do you report it as "people driving cars are affected" or do you report it as "people driving make X & model Y are affected"? You would look pretty silly if reporting the former and correct when reporting the latter. Why not do that here too?
Time to step up and no longer cave in to Microsoft's rather obvious PR tricks.
Don't take this the wrong way, but it would be nice if you could point out to the folks less tech educated that this is a Windows OS problem that the BBS has and does not affect other systems.
As in OS X, Linux, Unix, BSD and other non-Microsoft operating systems.