[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISN] CA's website hacked by malware authors


By Robert McMillan San Francisco 
7 January, 2008

Part of security software vendor CA's website was hacked last week and 
was redirecting visitors to a malicious website hosted in China.

Although the problem now appears to have been corrected, cached versions 
of some pages in the press section of CA.com show that the site had been 
redirecting visitors to the uc8010.com domain, which has been serving 
malicious software since late December, according to Marcus Sachs, 
director of the SANS Internet Storm Center.

The hack is similar to last year's attack on the Dolphin Stadium 
website, which infected visitors looking for information on the Super 
Bowl football game, Sachs said. "It's exactly the same setup," he said. 
"It's JavaScript that they've managed to insert into the title or the 
body of the HTML."

CA itself may not even host the press release section of its site, as 
that job is often outsourced to a third party, Sachs said. Often a 
misconfigured application server or a web or database programming error 
can give hackers all the opening they need to insert their malicious 

"When you outsource, you've got to be just as (demanding) about security 
as you are with your own site," Sachs said.

CA representatives could not be reached immediately for comment.

The uc8010.com domain serves attack code that exploits a recently 
patched vulnerability in the RealPlayer multimedia software, Sachs said.

The criminals behind this domain have hacked tens of thousands of web 
pages and inserted code that redirects visitors to the malicious server, 
he added.

SANS has posted a note on the uc8010.com issue and recommends that IT 
staff block access to the domain. Sachs said another domain, ucmal.com - 
also hosted in China - should also be blocked because it is associated 
with a similar type of attack.

Visit InfoSec News