Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

NBC Websites Hacked To Serve Citadel Financial Malware

RedKit exploit kit launched drive-by malware attacks from NBC websites, targeted vulnerabilities in Java and Adobe Reader.

Multiple NBC websites were compromised by online attackers and used to launch drive-by attacks at visitors Thursday.

"At 16:43 CET [12:43 EST] this afternoon we noticed that the NBC.com website links to the redkit exploit kit that is spreading Citadel malware, targeting U.S. financials (sic) institutions," warned security analyst Barry Weymes at Dutch security firm Fox-IT in a Thursday blog post. "This version of Citadel is only recognizable by 3 out of the 46 antivirus programs on virustotal.com."

Malware-spewing NBC websites included the sites for Late Night with Jimmy Fallon and Jay Leno's Garage, according to a blog posted by Tony Perez, COO of security software vendor Sucuri.

In short order, Google was blocking some NBC websites from search results, warning that they appeared to be infected with malware. While some reports suggested that NBC expunged the malware after just 15 minutes, multiple security researchers reported that the infections persisted for at least four hours.

[ Attend Interop Las Vegas, May 6-10, and get the most thorough training on Apple Deployment at the NEW Mac & iOS IT Conference. Use Priority Code DIPR02 by March 2 to save up to $500. ]

Attackers appeared to have compromised the NBC websites using the RedKit attack toolkit, which then targeted users with attacks designed to exploit vulnerabilities in their Java browser plug-in, or Adobe Reader. The remotely exploitable Java bug (CVE-2013-0422) being targeted was discovered in January and patched last month. Meanwhile, the malicious PDF file served up by the malware was recognized Friday morning by only six out of 46 antivirus software packages, according to VirusTotal. Initial reports on the attack from security researchers didn't disclose if the Adobe Reader bug was a zero-day flaw, or previously discovered bug.

The iframe used in the attack called on an ever-changing list of external URLs to load attack code. "This tells us that something on the server is generating the payload," said Sucuri's Perez in his Thursday blog post. "This isn't an uncommon practice, it also tells us that the script is likely still on the box. The fact that it's impacting other sites tells us that the compromise might extend beyond the Web application and onto the server. If those other sites are stored on separate boxes then we're looking at a much bigger, network, compromise, but that is speculative at the moment."

By infecting a high-profile site such as NBC.com, which is one of the top 600 most popular sites in the United States, attackers had the opportunity to quickly infect numerous visitors. "Targeting media and news websites can vastly improve an attacker's chances of success," according to Fox-IT's Weymes, which was one of the first organizations to spot the attack. "Users presume these large organizations' websites to be free from malware. If an attacker can gain access to these Web servers, they can use them to distribute malware to every visitor of that Web server."

Attackers made the most of their exploit window, using RedKit to target PCs with up to three different exploit kits, including the Citadel crimeware toolkit, which is designed to steal financial information. According to Fox-IT, the attackers were targeting account details for numerous U.S. financial institutions, including American Express, Bank of America, Chase, Citibank, Citizensbank Online, Fifth Third Bank, Navy Federal Credit Union, PNC, Schwab, Suntrust, TD Ameritrade, USAA and Wells Fargo.

The drive-by NBC website attacks also infected some visitors with ZeroAccess malware, which is used to launch clickjacking attacks that generate fake pay-per-click revenues for botnet controllers or their clients. "ZeroAccess is a dangerous threat that uses stealth techniques in order to hinder its detection and removal," said SurfRight security researcher Erik Loman in a blog post.

RedKit served up a third piece of malware which has yet to be identified. "Some antivirus vendors identify this malware as Zbot or a rootkit ... but it is most definitely not Zbot and it's not a rootkit either," Loman said. "The malware binary has a curious name at the end 'SadokBdi,'" which may connect it to previously seen malware known as "Sadok."

The timing of the high-profile NBC attack may be tied to Oracle and Adobe having recently released patches for multiple critical vulnerabilities in Java, Reader and Acrobat. Once vendors release a patch, criminals often reverse-engineer the fix to reveal the underlying vulnerability, which they then begin targeting. Anyone who doesn't quickly update their software thus remains highly vulnerable to having their PC compromised by an attacker, which can lead to their personal financial account information being stolen, keystrokes recorded and their PC being made to serve as part of a botnet.

Owing to many users failing to update the Java Runtime Environment installed on their PCs, Java bugs in particular remain quite popular with -- and effective for -- attackers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
2/22/2013 | 8:52:22 PM
re: NBC Websites Hacked To Serve Citadel Financial Malware
Put the malware on NBC's prime time schedule and it will be canceled within two episodes.

Jim Donahue
Copy Chief
InformationWeek
Deirdre Blake
50%
50%
Deirdre Blake,
User Rank: Apprentice
2/22/2013 | 3:35:18 PM
re: NBC Websites Hacked To Serve Citadel Financial Malware
Bummer, I there'll be no slow jamming the news today.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-26077
PUBLISHED: 2021-05-10
Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring...
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.