Last night, Roger's Information Security Blog detailing the hacking of the legendary singer Van Morrison's website.
From the description of the hack I would have expected Sophos to have been detecting the site as Mal/Iframe-F. Naturally, I visited the site, in a secure manner, to see what I could see. Unfortunately, I didn't see an Iframe as described.
What I did see was a heavily obfuscated script injected into the page that references an iframe. A quick analysis of the obfuscated script revealed that it adds an iframe to the page to load content from a remote site (blacklisted for Sophos customers since Oct 7th). The WHOIS record that remote site strangely says:
Address : 56/2 Sun str.
City : Dallas
Province/State : beijing
This morning I wrote detection for the obfuscated script, as Troj/Iframe-DD.
After further digging on our systems we have seen multiple infections on this site:
- Mal/Badsrc-A first seen 2009-10-15
- Mal/iframe-F first seen 2009-08-05
How long has the site been infected? and how many infections will it have before the sites security is updated?
![Password security infomerical leaves Ellen DeGeneres in disbelief.. and it will you too [VIDEO]](http://sophosnews.files.wordpress.com/2013/04/ellen-thumb.jpg?w=75&h=75&crop=1)
![Can multiple moving cursors really hide your password from spyware and peepers? [VIDEO]](http://sophosnews.files.wordpress.com/2013/03/cursors-thumb.jpg?w=75&h=75&crop=1)
