Cisco Blogs


Cisco Blog > Security

Crumbling to the Cookiebomb

Recently we have seen a spate of government websites hosting malicious Cookiebomb JavaScript. We have observed URLs with the top level domains such as ‘.gov.uk’, ‘.gov.tr’, ‘.gov.pl’ and the website of a middle eastern embassy in the US become compromised and expose visitors to malware infection. For malicious actors, highly reputable websites are a valuable target to compromise. Politically motivated attackers, such as the Syrian Electronic Army, can use these websites to highlight their cause, to cause embarrassment to an adversary, or to spread malware, possibly as part of a watering hole attack. Profit motivated distributors of malware can use these websites to infect the steady stream of visitors who trust the website and who are unlikely to suspect that it has been compromised.
Read More »

Tags: , , , ,

Syrian Electronic Army Cracks ShareThis.com GoDaddy Account

ShareThis provides a mechanism for web surfers to share content online through a customizable widget.  According to the information on their website, ShareThis interacts with “more than 94% of U.S. Internet users across more than 2 million publisher sites and 120+ social media channels.” On the evening of August 21, 2013, ShareThis reported that their website was experiencing “technical difficulties.” They posted a follow-up tweet the morning of August 22 declaring that the service was functioning properly.  What ShareThis did not disclose however, was that their GoDaddy domain account was compromised by the Syrian Electronic Army.

ShareThis goes down Aug 21ShareThis regains control Aug 22

Read More »

Tags: ,

The Highs and Lows of the Pump and Dump Scam

The Internet remains an environment where it is important to keep your wits. The recent indictment of nine individuals on stock fraud charges reminds us that the pump and dump scam continues to be perpetrated [1][2]. Stock spam emails were particularly prevalent during the mid-2000’s, with these messages reportedly comprising 15% of all spam in 2006 [3]. These messages sought to artificially increase demand for infrequently traded stocks so that fraudsters could unload cheaply bought shares at a profit to unsuspecting investors.
Read More »

Tags: , , ,

DEFCON 21 Wrapup

My first DEFCON was DEFCON Three, held at the Tropicana Hotel in Las Vegas.  The computer security conference scene was much, much smaller back then, but DEFCON had already become THE security conference of the year. Since that time I’ve continued to regularly attend DEFCON, and over the years I have collected some very fond memories of summer computer security conventions past.  I remember vividly when the Cult of the Dead Cow celebrated their release of Back Orifice.  I recall battling the Las Vegas heat in the large, “air-conditioned” tents at the Alexis Park Hotel.  I remember when the NBC Dateline journalist was outed at DEFCON after planning to surreptitiously record attendees confessing to hacking crimes.  I remember seeing the authorities hauling away a fake Automated Teller Machine (ATM) that had been installed in the Riviera.  Fun times…

defcon

Read More »

Tags: ,

DNS Compromise Distributing Malware

DNS records are an attractive target for distributors of malware. By compromising the DNS servers for legitimate domains, attackers are able to redirect visitors to trusted domains to malicious servers under attacker control. DNS requests are served from dedicated servers that may service many thousands of domains. Compromising these servers allows attackers to take over domains as a wholesale attack, serving malware from any domain that uses the DNS service.
Read More »

Tags: , ,