News 24 Hacked

O

ozziej

Senior Member
Joined
Jul 22, 2009
Messages
735
Reaction score
103
Location
Johannesburg
Hi, okay the STRANGEST thing happened today.

Went to news24.com , clicked on a link on the home page about CSA and SARU being scammed.

Except, when I clicked on the link instead of (http://www.sport24.co.za/Cricket/CSA-SARU-targeted-by-scammer-20120206) I got a redirect to this url http://elstr85uctura.rr.nu/

Then suddenly I got a file downloaded that claimed to be a Flash player installer...
Okay, things are starting to sound dodgy... So I look at the flash player, its 208KB a bit small. So I dig into it.
Also, the site I got a redirect to no longer has the page I was sent to, that had a whole bunch of flash elements on it.

Its an XAR archive (which I am NOT going to try and open)
But the file came from: http://flashplayerupdate.rr.nu/7f/ (which is now dead)

This took about 1- 2 minutes, in that time someone at news 24 obviously fixed the redirect and its now gone.

Anyone else have this happen to them?
 
XSS vulnerability? Need screenies!
 
Wish I could have grabbed screenshots, but the whole thing vanished before I could. I checked the actual file that it downloaded and it was a genuine Flash Installer app... It was really strange and unfortunately only worked the couple of times I tried. I was so taken aback by the fact that news 24 got hacked, that I just didn't get a chance to screen grab it...
 
News24 was hacked? Ah, that explains his incestuous urges then... for a minute there I thought he was just a typical sicko.
 
I wonder what news24's response is on this matter? Or maybe he's fled the country again :D
 
I get their newsletter mailed to me - it didn't happen this morning. Maybe this adds up to trouble...
 
Either injected into news24's site to redirect you, or you've been infected with a virus before that had you redirect now suddenly.

All in all, your machine isn't clean anymore, so I'd invest in some solid anti-virus software and stop using IE as your browser
 
AcidRaZor said:
Either injected into news24's site to redirect you, or you've been infected with a virus before that had you redirect now suddenly.

All in all, your machine isn't clean anymore, so I'd invest in some solid anti-virus software and stop using IE as your browser
Click to expand...

Best advice.
 
Option 3 is you have a proxy virus (not sure what they are really called). Them little critters will redirect you every so often to a page that the authors want to redirect you to... no matter what site you are on. It's quite intermittent so you don't pick it up all the time. This is more likely than News24 fixing an intrusion that quickly.

I highly recommend a good scan from a good anti-virus program or two.
 
shogun said:
Option 3 is you have a proxy virus (not sure what they are really called). Them little critters will redirect you every so often to a page that the authors want to redirect you to... no matter what site you are on. It's quite intermittent so you don't pick it up all the time. This is more likely than News24 fixing an intrusion that quickly.

I highly recommend a good scan from a good anti-virus program or two.
Click to expand...

What shogun said. I had one of them a few months ago.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X