ColdFusion Muse

VB Script For Iframe Injection Attack

Posted At : April 23, 2009 1:14 PM | Posted By : Mark Kruger
Related Categories: ColdFusion, Security

Thanks to Nate from CF-Talk I have a copy of the malicious VBS script that is doing the damage. If you are being victimized by this attack and you need to see the script for whatever purpose, let me know and I will make sure you get a copy. I now it goes without saying, but just don't run it :).

Meanwhile there is some consensus, given the root access of this code, that an infected server cannot be trusted even after a thorough cleaning. Dave Watts and Tom Chiverton both gave such advice. While it's not always possible and it's a huge hassle, it might be the best solution to bite the bullet and do it.

Comments (3) | Print | del.icio.us | Digg It!

Related Blog Entries

Comments
[Add Comment] [Subscribe to Comments]
Brian W's Gravatar I think there may be something missing from your last sentence... bite the bullet and go ahead and do what? Are you saying do a "thorough cleaning"? If the server cannot be trusted even after a thorough cleaning, is the advice a new server?

I'm glad to say I haven't been bitten by this particular issue, since I'm not using VBS and on Linux, but I'm always curious about serious infections. Steve Gibson has said in the past that once a machine is infected with "sophisticated" code, since even a new harddrive does not save you if the bios is infected, that anything short of a new machine can never be 100% trusted.

What does everyone think of that?
# Posted By Brian W | 5/27/09 1:29 PM
Mark Kruger's Gravatar @Brian,

You are correct... that's not very clear. I mean bite the bullet and completley start over - whether that means a new server or whatever. Bios infections are very rare - but what distingishes this infect from others is that it is not really pattern based and does not appear to be automated. Instead, it appears that the individual in question is "matching wits" with an actual hacker who has control of the machine. In that case (and given what the hacker has been able to accomplish is substantial) the user may well need to start with fresh hardware - or at least low level format the drives and flash the bios (which would turn the trick in 99.999 percent of cases).
# Posted By Mark Kruger | 5/27/09 1:50 PM
Tim's Gravatar OMG how the server infected usually? I've just removed iframe infection from the customer's web site and really care of any suspicious code exists in the system. Can you please give me copy of the script? Thank you!
# Posted By Tim | 7/7/09 8:05 AM
[Add Comment]



Blog provided and hosted by CF Webtools. Blog Sofware by Ray Camden.