Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Hundreds of DreamHost websites abused by spammers

Zsclaer identified rogue PHP redirect scripts uploaded on hundreds of websites hosted at DreamHost

Rogue PHP pages that redirect users to work-at-home scams have been added to hundreds of websites hosted at DreamHost following a security breach suffered by the company in January, researchers from cloud security vendor Zscaler said.

DreamHost decided to reset the FTP and shell access passwords for all of its customers after discovering that hackers compromised one of its database servers on Jan. 20.

The company said at the time that no malicious activity had been immediately detected on its customers' accounts, but the situation might have changed in the meantime, according to Zsclaer.

Following the Dreamhost hack many websites hosted by the company have been hijacked to redirect users to a Russian scam page, said Zscaler senior security researcher Julien Sobrier in a blog post on Friday. "I've identified hundreds of websites hosted by DreamHost that contained a PHP page redirecting to hxxp://www.otvetvam.com/."

The landing website promoted a work-at-home scam in Russian. These kind of scams have been around for many years and they usually trick users into buying a so-called starter kit that is supposed to help them earn money on the Internet.

"I'm sure this is just the beginning of massive abuses on websites hosted by DreamHost," Sobrier said. However, other Web security researchers are not convinced that these attacks are necessarily connected to the DreamHost breach.

Website integrity monitoring firm Sucuri Security has been tracking these attacks and similar ones for a while now and it can't say whether they started after the DreamHost security breach or that they affect only websites hosted there, said David Dede, a security researcher with the company.

According to Dede, most of the compromised websites analyzed by Sucuri had outdated software and other security issues.

Independent security researcher Denis Sinegubko, who created the Unmask Parasites Web scanner, looked at some of the compromised websites given as examples by Zscaler and determined that they all had a backdoor PHP script installed on Dec. 26, long before the DreamHost breach. It might still be an infrastructure-wide compromise though, he said.

Sinegubko was also able to tell who was behind this attack campaign because he'd seen some of the spam domains before. "It's the gang that promotes one of the largest scam campaigns in Russian," the researcher said. "They target themes such as genealogy, horoscopes, medical devices, diets, free downloads, and all other sorts of snake oil."

Regardless of whether these sites were compromised as a result of stolen credentials, vulnerabilities in outdated software or a misconfiguration, webmasters should follow security best practices. These include regularly reviewing the access logs for suspicious activity, checking their Web directory trees for any newly created files that look out of place, changing their administrative passwords regularly and keeping their software up to date. Scanning their websites with free services like Zulu, Sucuri or Unmask Parasites, is also recommended.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Hewlett-Packard, HP, Zscaler
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: DreamHost, Exploits / vulnerabilities, security
Latest Blog Posts
Whitepapers
  • Botnets: The dark side of cloud computing
    Botnets pose a serious threat to your network, your business, your partners and customers. Botnets rival the power of today’s most powerful cloud computing platforms. These “dark” clouds, controlled by cybercriminals, are designed to silently infect your network. Left undetected, botnets borrow your network to serve malicious business interests. This paper details how you can protect against the risk of botnet infection using security gateways that offer comprehensive unified threat management (UTM).
    Learn more »
  • Seven Tips for Securing Mobile Workers
    Seven Tips for Securing Mobile Workers is intended to offer practical guidance on dealing with one of the fastest growing threats to the security of sensitive and confidential information.
    Learn more »
  • Case Study: Keeping information on the move: Clearswift protects Maman, the logistics experts
    Time is money. Every minute a consignment is held up in transit costs money and causes problems. Web and email are mission critical business tools that enable Maman, and their customers, to efficiently collaborate with partners across the globe. Spam, and other web based threats can result in delays that ultimately lead to missed deadlines - keeping the lines of communication open is therefore a key priority for Maman. Read on.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments