Web malware

Case Study: Analyzing a WordPress Attack – Dissecting the webr00t cgi shell – Part I

November 1st started like any other day on the web. Billions of requests were being shot virtually between servers in safe and not so safe attempts to access information. After months of waiting, finally one of those not so safe request hit one of our honeypots. We won’t get into the location of the site […] more…

Server Update Time: OpenSSH Vulnerability Disclosed

The OpenSSH team just released a security advisory about a vulnerability affecting both OpenSSH 6.2 and 6.3. If you are not familiar with OpenSSH, it’s the software used by a large majority of servers and hosting providers to provide SFTP and SSH services. Any vulnerability discovered in OpenSSH could have a major impact to website […] more…

Blackhat SEO and ASP Sites

It’s all too easy to scream and holler at PHP based websites and the various malware variants associate with the technology, but perhaps we’re a bit too biased. Here is a quick post on ASP variant. Thought we’d give you Microsoft types some love too. Today we found this nice BlackHat SEO attack: Finding it […] more…

Google Bots Doing SQL Injection Attacks

One of the things we have to be very sensitive about when writing rules for our CloudProxy Website Firewall is to never block any major search engine bot (ie., Google, Bing, Yahoo, etc..). To date, we’ve been pretty good about this, but every now and then you come across unique scenarios like the one in […] more…

Joomla – Fancy SPAM Injections

Malware writers can be really ingenious when it comes to obfuscating their code. And let’s face it, in today’s anti-malware push, they have to; the slightest variation will often trigger warnings that will make it look suspicious in turn shortening its life-span. When we talk about obfuscation the first thing we think is base64 encoding, […] more…

Understanding Search Engine Warnings – Part I – Google – This Site May Be Hacked

If you have any questions about malware, blacklisting, or security in general, send them to us: contact@sucuri.net and we will answer here. For all the “Ask Sucuri” answers, go here. Question: I just found out that my site is being flagged on Google’s search engine results page with the message “This site may be hacked”. […] more…

Backdoor Evasion Using Encrypted Content

A few weeks ago on the Sucuri Research Labs we mentioned a new type of malware injection that does not use base64_decode, and instead conceals itself as a variable and is built with a combination of “base_” + (32*2) + “_decode”. This is the part of the code where it is hidden: $g___g_='base'.(32*2).'_de'.'code'; Any tool […] more…

Sucuri Affiliate Updates

We have been running a quite successful (but stealthy) affiliate program for a few years, paying our partners very well. Our goal has always been to allow our clients that already love what we do, to make some money when they also send their friends or customers to us. However, as our affiliates know, the […] more…

Cleaning Up Your WordPress Site with the Free Sucuri Plugin

If your site has been recently hacked and you are trying to clean it up yourself, we recommend that you use Sucuri Security – SiteCheck Malware Scanner, our Free WordPress plugin to help you during that task. The plugin has a collection of useful tools that can guide you along the way. The steps provided […] more…

Sucuri CloudProxy WAF Plugin for WordPress

If you are using our CloudProxy WAF to protect your WordPress websites, we highly recommend that you also install our new CloudProxy plugin for WordPress. It has been public for a few weeks, and now we feel it is ready for production use, hence the announcement. You can download the plugin from WordPress Plugin Directory, […] more…

Avira, AVG and WhatsApp Defaced

If you visited the web sites for Avira, AVG or WhatsApp this morning, you probably saw that they didn’t look like they should. All of them were defaced and looked like this: It is a bit horrifying when you see such big sites, including security sites from major Anti Virus products (like AVG and Avira) […] more…

WHMCS SQL Injection Vulnerability in the Wild

A few days ago, a zero-day SQL injection vulnerability in WHMCS was disclosed by localhost.re, along with the exploit code. It was quickly patched by the WHCMS team and rated as critical since it allows an attacker full access to the database hosting WHMCS: The vulnerability allows an attacker, who has valid login to the […] more…

Malware Iframe Campaign from Sytes(.)net

For the last few weeks we have been tracking a large malframe (malicious iframe) campaign that has been injecting iframes from random domains from sytes(.)net into compromised sites. Malicious iframe injection is nothing new, the bad guys have been using no-ip.org domains for a long time. But what is catching our attention is how often […] more…

WordPress Database Table and wp_head Injections

There are multiple places where a malware injection can be hidden on a web site. On WordPress, for example, it can be hidden inside the core files, themes, plugins, .htaccess and on the database. More often than not, the malware uses a combination of those which makes it harder to detect. Today, we will talk […] more…

CloudProxy WAF – September Report

*By Tony Perez and Daniel Cid As many of you are aware we released a website protection tool (WAF+IDS) at the beginning of the year and over the months we have been working with the data we’ve been accumulating. We’re finally at a place where we think we can provide better insight into the world […] more…

Sucuri Expands Research Efforts with Acquisition of Unmask Parasites

Our goal at Sucuri is to be the best website security company of today and in the future. To help build on our existing research efforts, and to expand our ability to scan websites and detect malware, we are very excited to announce the acquisition of Unmask Parasites. Unmask Parasites is an online website security […] more…

« Older posts

Newer posts »