Monthly Archives: July 2009

Hiding an infection in an unused SSL site

Today we saw an interesting case where no one could find badware in a website that Google reported as infected—until Google tipped us off to check the site using https (i.e., instead of testing http://example.com, we tested https://example.com). Sure enough, … Continue reading

Tagged , , | Comments Off

How criminals make money from compromised websites

A couple weeks ago, I wrote about a trend of websites being compromised because the webmaster’s computer had a Trojan that was stealing FTP credentials for the site. The folks at Finjan recently released a report detailing the operations of … Continue reading

Tagged , , | Comments Off

Interns needed at our Cambridge office

We’re looking for one or two good interns to help us with badware website testing and to periodically chip in on QA testing of other Berkman Center websites. If you know of someone near Cambridge, MA who is available 8 … Continue reading

Tagged , | Comments Off

Community member describes meta redirects

BadwareBusters.org community member Denis describes an emerging web-based malware attack over on his Unmask Parasites blog, and he is seeking additional information: I’ve discovered a new emerging malware attack today. Actually two attacks, but in this post I’ll review only … Continue reading

Tagged , | Comments Off

Login problems with Google Webmaster Tools

Some users are reporting difficulty logging into Google’s Webmaster Tools, a console that allows website owners to do a number of Google-related tasks, including requesting a review after removing malware from a site. Google is aware of the issue and … Continue reading

Tagged , | Comments Off

Rise of Botwebs

 Botnets have been a fixture of the internet for many years. Their command and control structures have evolved greatly but their methods of propagation have largely gone unchanged. The recent advent of drive-by downloads have been part of a new … Continue reading

Tagged , , , , | Comments Off

bit.ly acts to protect users, but not using SBW data

A story over on TechCrunch.com last night reported that URL-shortening service bit.ly, well known to Twitter users, has started warning users of links that may lead to badware. The article indicated that some of the data was coming from StopBadware. … Continue reading

Tagged , | Comments Off

Local malware causes infected websites

Over on BadwareBusters.org, we are seeing a trend of websites that have been infected because the webmaster’s personal computer was infected. Specifically, the local malware seeks out saved usernames and passwords in popular FTP clients like CuteFTP and Filezilla and … Continue reading

Tagged , , | Comments Off

StopBadware featured on Data Security Podcast

StopBadware was featured in the form of an interview with me on yesterday’s episode of the Data Security Podcast. (Disclosure: Sunbelt Software sponsors the podcast and is also a data partner of StopBadware. We didn’t realize the connection until after … Continue reading

Tagged , | Comments Off

WordPress still a common entry point for bad code

The popular blogging platform WordPress, and its multi-user counterpart WordPress MU, continue to be common entry points for badware. In a typical scenario, a security vulnerability is discovered and patched, but many website owners running WordPress do not install the … Continue reading

Tagged , , | Comments Off