Ramblings of an old Doc

 

 

Just saw this on ZDNet. Websense® ThreatSeeker® Intelligence Cloud has detected that the official website of Popular Science has been compromised and is serving malicious code (iFrame).

The code is of the redirect type and will send the user to other websites which will drop malicious files (RIG Exploit Kit) on the victim’s computer. RIG is an executable. If the user doesn’t have any of the checked AVs installed, then the exploit kit proceeds to evaluate the installed plug-ins and their versions, in particular Flash, Silverlight, and Java. If a vulnerable plug-in is found, the appropriate exploit is launched.

Just so you know, PopSci has been notified…but if you’ve been there recently, best you head over to herdProtect and let it scan your system. If the results come back positive on several AVs you’d best get busy changing passwords and checking your credit card/banking, etc. accounts

Source:

http://www.zdnet.com/zero-day-weekly-currentc-hacked-white-house-breached-apt28-exposed-verizon-shamed-7000035269/


Comments
on Oct 31, 2014

Note that it appears that the attackers are relying on an ActiveX exploit, which means that you are only vulnerable if you're using IE (generally speaking anyway, since there are plugins and such to run ActiveX in other browsers).

on Oct 31, 2014

Thanks for the heads up!

on Oct 31, 2014

Thanks, kryo. The articles I viewed didn't mention that.

on Oct 31, 2014

Thanks doc,   I visit that site on occasion.  Not in over a month.  Safe?

on Oct 31, 2014

Probably. To be sure, go to herdProtect.com (MS site), and dl the small scanning app.

on Oct 31, 2014

Actually, I run herd protect 2 -  3 times a week.  The only lapse I have found with herd protect is it seems to miss the PUP malware that malwarebytes finds.  Herd is good!

on Oct 31, 2014

PUP is pop up...and it isn't malware. If you notice, Malwarebytes calls it "Non-malware".

It's usually firefox related pop-ups detected by Malwarebytes.

on Oct 31, 2014

A PUP is a Potentially Unwanted Program. It has little to nothing to do with pop-ups.

Source: http://www.pcmag.com/encyclopedia/term/55704/pup

It's all that junk that wants to come along with a software install if you do not select "Advanced" or "Custom" and uncheck those little boxes.

on Oct 31, 2014

Oh, I thought I got rid of the pups 6 months ago.  Havn't downloaed anything since.  ummmmm

on Oct 31, 2014

On my machine they were associated with Firefox (pretty sure they were with yours as well).

I dl'd it from the mozilla.org's website. Not sure why there would be pups there...

This might explain it: Malwarebytes adopted a very aggressive posture regarding PUPs.

https://forums.malwarebytes.org/index.php?/topic/130156-malwarebytes-adopts-aggressive-pup-policy/

 

on Oct 31, 2014

Great post Doc. As always, you bring some great stuff to our attention.

FF, Chrome, Adobe, c|net, it doesn't matter who, they ALL have a little "bundle of joy" included for those who are not savvy enough to know how to opt out. Downloaders, Wrappers, whatever they chose to call them, well, those PUP's are what they peddle.

 With the addition of Malwarebytes Chameleon  there isn't much better in the way of malware removal tools. Those guys at Malwarebytes know their stuff. I cannot recommend them highly enough.  I have used many many anti-malware tools on a wide range of machines, In all but the severely infected, MWB gets the job done. At the risk being considered spam, I say buy the pro version if your budget allows......, support the developers.

on Nov 02, 2014

I have to agree about Malwarebytes Chamelion. I also agree about the Pro version. It's worth it imo as well, Wiz.

Folks: You can find the full list of Malwarebytes' paid and free utilities here: http://www.malwarebytes.org/downloads/#tools , if you're interested in learning more.