Março 2, 2010

BBS of Sougou Compromised

Forcepoint Security Labs

Websense® Security Labs™ ThreatSeeker™ Network has discovered that the BBS of Sougou has been compromised.

The Sougou BBS home page and other pages on the site have been injected with a malicious script. The script creates an IFrame that redirects users to an exploit site: a 5-day old domain at [snip]ow.info. The latter performs some checks before delivering the exploits, in order to subvert any analysis attempts.

At the time of writing this alert, the BBS of Sougou is still injected with the malicious script, but the exploit site is down. This could change at any moment.

This is the injected code in the home page and its contents:

Here is the exploit page:

Websense Messaging and Websense Web Security customers are protected against this attack.

Forcepoint Security Labs

These posts are based on research done by Forcepoint's X-Labs.

Leia mais artigos do Forcepoint Security Labs

Sobre a Forcepoint

A Forcepoint é líder em cibersegurança para proteção de usuários e dados, com a missão de proteger as organizações ao impulsionar o crescimento e a transformação digital. Nossas soluções adaptam-se em tempo real à forma como as pessoas interagem com dados, fornecendo acesso seguro e habilitando os funcionários a criar valor.