nbc dot com infected with malware

[seepy83]

Should go in the Security forum, but I thought I would reach more people in OT.

Stay away from nbc dot com until this is cleared up. Infected iFrame re-directing users to servers that attempt to download citadel (nasty malware).

http://isc.sans.edu/diary/NBC+site+redirecting+to+Exploit+kit/15223

 

[Vdubchaos]

Even without malware, going to that site is like getting infected anyways.

 

[techs]

It's a good thing nobody watches NBC anymore.

 

[fjmeat]

It's a good thing nobody watches NBC anymore.

lol true

 

[waggy]

It's a good thing nobody watches NBC anymore.

booo! lol

 

[Anonemous]

http://www.zdnet.com/nbc-com-hacked-briefly-compromised-with-redkit-malware-7000011636/

 

[Jon-T]

When a story like this is posted I wish they would give some additional information.

Does this infect every visitor? No defense.

Will being up to date protect the user? Does this exploit only work on older unpatched software versions?

Do the most common anti-virus anti-malware offer protection protect from it?

How to check for and remove any infection.

 

[seepy83]

Jon-T,
There are more details here that should answer your questions - http://hitmanpro.wordpress.com/2013/02/21/nbc-com-hacked-serving-up-citadel-malware/

Understand that when I posted this thread, this was an active incident and there wasn't much information available. This thread was posted mostly as a warning to stay away from the infected site.

 

[bbhaag]

My brother was on MSN this morning and got hit. He was using his work computer which is pretty bad. He came and got me but it was to late....damage done.:| I hope I can get it straightened out because he has a lot of our business' banking and credit card info on it.

 

[mechBgon]

When a story like this is posted I wish they would give some additional information.

Visitors were getting redirected to an exploit kit. For practical countermeasures (on Windows, anyway), I can especially recommend steps #3-#9, plus #16, in my Windows security guide yonder: http://www.mechbgon.com/security

These exploit kits will survey what you've got to attack (your browser, plug-ins, utilities, media players and OS), then take their best shot.

Java's the top target; if you don't need it at all, uninstall it completely. If you need it for something other than Web browsing, update it to the latest version and disable it in your Web browsers completely: http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/

Adobe Reader is another target. Uninstall older versions (8, 9, 10) and install Reader 11 (Adobe's FTP site: ftp://ftp.adobe.com/pub/adobe/reader ), then lock it down by going to its Edit > Preferences and doing like this:

There's more you can do if you want: http://security.thejoshmeister.com/2010/05/7-easy-steps-to-increase-adobe-reader.html Alternatively, if you're on Windows 8 (yes, all three of you), then you can use the built-in Win8 PDF reader.

 

[jumpncrash]

just went to the site...nothing seems to have happened, is it fixed?

 

[Lyfer]

Boobies.

 

[SparkyJJO]

Even without malware, going to that site is like getting infected anyways.

lol so true.

 

[KeithP]

Apparently it was just a big misunderstanding. Computers weren't getting infected with malware, NBC was just automatically streaming episodes of "Whitney" to site vistors.

-KeithP