Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/12/2009
07:53 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Paris Hilton's Web Site Infected With Malware

A security company said it found a similar threat, a malicious ad, on Major League Baseball's MLB.com last week.

Once again, hackers have targeted technology associated with Paris Hilton.

This time it's her Web site, ParisHilton.com.

Security researchers at ScanSafe report that anyone visiting Hilton's site risks infection with malware.

"Hilton's popular website, ParisHilton.com, has been outfitted with malware prompting site visitors to 'update' their system in order to continue navigating the site," ScanSafe said in an e-mail. "When the bogus pop-up box appears, users have the option to click 'Cancel' or 'OK.' Regardless of which option they choose, destructive malware will be downloaded to the user’s computer."

InformationWeek could not actually load her site because our Web filter blocks the site as malicious.

ScanSafe says the malware has been detected on some 15,000 other Web sites. The company says it found a similar threat, a malicious ad, on Major League Baseball's MLB.com last week.

"Paris Hilton's site is currently compromised," said Mary Landesman, senior security researcher at ScanSafe, in a phone interview. "We first encountered it on [Jan. 9]. We don't know when it happened."

According to Landesman, there's an iFrame that has been embedded in the ParisHilton.com Web site. The iFrame calls out to a site hosting the malware, you69tube.com. It downloads a malicious PDF and attempts to force users into clicking and launching the PDF, which attempts to activate an exploit.

Because the malware tries to download additional files whether one clicks "Cancel" or "OK," Landesman says that only a hard quit -- CTRL+ALT+Delete -- of one's browser provides a way out.

It's not clear which exploits get launched. "These exploit frameworks generally include a cocktail of potential compromises," said Landesman. "The exploit being used appears to have been patched in November, but that has not been confirmed."

She said it wasn't clear how the iFrame got added to Paris Hilton's site, but she said it could be because of a vulnerability in the open source content management system Joomla, which has been a common factor in other reports.

According to Landesman, only seven out of 38 antivirus products detect the malware.

Hilton's association with technology seems to invite attacks, even as cybercriminals are increasingly moving toward lower-profile schemes to escape scrutiny from law enforcement. In 2005, Hilton's Sidekick mobile phone was hacked, exposing private photographs and data. The teen responsible received an 11-month sentence in a juvenile facility.

In March 2008, a security researcher was able to bypass Facebook's privacy controls to access pictures of the hotel heiress, among others.

If celebrities and the demi-famous continue be targeted by cybercriminals, they may want to expand their entourages to include IT security pros. Landesman believes celebrities owe that much to their fans. "Their sites, because of their celebrity, are going to enjoy pretty heavy traffic. And they have an obligation to their fan base to keep it safe."

Editor's Note: Correspondents close to the Joomla community have contacted InformationWeek asserting that ParisHilton.com does not use the open-source content management system, as stated in the story. In a follow-up e-mail, Scansafe writes that their researcher Mary Landesman: noted that "it was impossible to tell where the exploit originated from, but that it was a possibility that it came from Joomla. Mary noted that we encountered some victims discussing the problem online who were questioning whether the ParisHilton.com malware was connected to Joomla." We have contacted ParisHilton.com for further information.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Data Loss Spikes Under COVID-19 Lockdowns
Seth Rosenblatt, Contributing Writer,  5/28/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13817
PUBLISHED: 2020-06-04
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attac...
CVE-2020-13818
PUBLISHED: 2020-06-04
In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.
CVE-2020-6640
PUBLISHED: 2020-06-04
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Description Area.
CVE-2020-9292
PUBLISHED: 2020-06-04
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
CVE-2019-16150
PUBLISHED: 2020-06-04
Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded ...