Vulnerabilities / Threats
1/12/2009
07:53 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Paris Hilton's Web Site Infected With Malware

A security company said it found a similar threat, a malicious ad, on Major League Baseball's MLB.com last week.

Once again, hackers have targeted technology associated with Paris Hilton.

This time it's her Web site, ParisHilton.com.

Security researchers at ScanSafe report that anyone visiting Hilton's site risks infection with malware.

"Hilton's popular website, ParisHilton.com, has been outfitted with malware prompting site visitors to 'update' their system in order to continue navigating the site," ScanSafe said in an e-mail. "When the bogus pop-up box appears, users have the option to click 'Cancel' or 'OK.' Regardless of which option they choose, destructive malware will be downloaded to the user’s computer."

InformationWeek could not actually load her site because our Web filter blocks the site as malicious.

ScanSafe says the malware has been detected on some 15,000 other Web sites. The company says it found a similar threat, a malicious ad, on Major League Baseball's MLB.com last week.

"Paris Hilton's site is currently compromised," said Mary Landesman, senior security researcher at ScanSafe, in a phone interview. "We first encountered it on [Jan. 9]. We don't know when it happened."

According to Landesman, there's an iFrame that has been embedded in the ParisHilton.com Web site. The iFrame calls out to a site hosting the malware, you69tube.com. It downloads a malicious PDF and attempts to force users into clicking and launching the PDF, which attempts to activate an exploit.

Because the malware tries to download additional files whether one clicks "Cancel" or "OK," Landesman says that only a hard quit -- CTRL+ALT+Delete -- of one's browser provides a way out.

It's not clear which exploits get launched. "These exploit frameworks generally include a cocktail of potential compromises," said Landesman. "The exploit being used appears to have been patched in November, but that has not been confirmed."

She said it wasn't clear how the iFrame got added to Paris Hilton's site, but she said it could be because of a vulnerability in the open source content management system Joomla, which has been a common factor in other reports.

According to Landesman, only seven out of 38 antivirus products detect the malware.

Hilton's association with technology seems to invite attacks, even as cybercriminals are increasingly moving toward lower-profile schemes to escape scrutiny from law enforcement. In 2005, Hilton's Sidekick mobile phone was hacked, exposing private photographs and data. The teen responsible received an 11-month sentence in a juvenile facility.

In March 2008, a security researcher was able to bypass Facebook's privacy controls to access pictures of the hotel heiress, among others.

If celebrities and the demi-famous continue be targeted by cybercriminals, they may want to expand their entourages to include IT security pros. Landesman believes celebrities owe that much to their fans. "Their sites, because of their celebrity, are going to enjoy pretty heavy traffic. And they have an obligation to their fan base to keep it safe."

Editor's Note: Correspondents close to the Joomla community have contacted InformationWeek asserting that ParisHilton.com does not use the open-source content management system, as stated in the story. In a follow-up e-mail, Scansafe writes that their researcher Mary Landesman: noted that "it was impossible to tell where the exploit originated from, but that it was a possibility that it came from Joomla. Mary noted that we encountered some victims discussing the problem online who were questioning whether the ParisHilton.com malware was connected to Joomla." We have contacted ParisHilton.com for further information.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.