Dynamoo's Blog: msi.com hacked with kristians1.net

[Massman]

Yeah ... this is going to be a massive PR problem, I think. Two questions:

 

1) Will MSI issue a press release to acknowledge the issue and inform the public when it's solved?

2) How did the virus get there?

 

The website of msi.com (a major computer manufacturer) has been hacked and is serving up malware, despite MSI being informed of the problem. Injected code pointing to the domain kristians1.net (83.143.81.2, ServeTheWorld AS Norway) has been injected into the site and is serving up an exploit kit (report here).

 

This is not the only time msi.com has been hacked. Most significantly, they recently had 50,000 accounts leaked and their site defaced. Zone H also reports several recent defacements and Google reports that part of the site has been listed as containing malware 4 times over the past 90 days.

 

What is the current listing status for msi.com?

 

This site is not currently listed as suspicious.

Part of this site was listed for suspicious activity 4 time(s) over the past 90 days.

 

What happened when Google visited this site?

 

Of the 2470 pages we tested on the site over the past 90 days, 16 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-07-15, and the last time suspicious content was found on this site was on 2013-06-16.Malicious software includes 23 exploit(s), 2 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

Malicious software is hosted on 5 domain(s), including abdelmonem.net/, oportunidadesdesdesucasa.com/, jobsreal.biz/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including for-test-only.ru/.

This site was hosted on 10 network(s) including AS12859 (NL), AS26228 (SERVEPATH), AS8220 (COLT).

 

Has this site acted as an intermediary resulting in further distribution of malware?

 

Over the past 90 days, msi.com appeared to function as an intermediary for the infection of 1 site(s) including 2k11.co.za/.

 

http://blog.dynamoo.com/2013/07/msicom-hacked-with-kristians1net.html

[Vivi]

hey 2k11.co.za is a local site here lol. totally junk ripoff site tho, i never use it, seems fake looking

[TaPaKaH]

could the hackers be responsible for weird MOA rules?

[knopflerbruce]

I have nothing to do with this. I swear

[sin0822]

some dudes hacked my site, but I know who they are now.

[CL3P20]

some dudes hacked my site, but I know who they are now.

 

Did you have to follow the cookie crumbs?

[M.Beier]

So basicly MSI users are in risk when wanting to update their drivers, that really sucks...

Could you, Massman, find compare info with ASUS, ASRock, Gigabyte and others, to see if its a common thing, or just MSI having issues?

 

some dudes hacked my site, but I know who they are now.

 

LOL, good stuff Im not being accused of this one hah

[sin0822]

Did you have to follow the cookie crumbs?

I had a friend do it. I don't like software.

[Dreadlockyx]

Seems like a JavaScript injection. I personally don't know how to do it, but I think you've got to change the source code of a page for the code to be executed.

[simples]

Dear All - Especially Mr VIVI!!! Please note that our website is being named here as a "total junk ripoff site" and "looking fake".

 

Please note that 2k11.co.za is a totally legitimate and registered online business and we do not take kindly to this kind of badmouthing of our business without reason.

 

2k11 Management

[DrWeez]

Maybe ripoff was the wrong wording, did you mean overpriced? bad MR VIVI,

[SoF]

Please note that 2k11.co.za is a totally legitimate and registered online business and we do not take kindly to this kind of badmouthing of our business without reason.

 

2k11 Management

 

Captain here:

 

Dear all - take note that they are up-to-date, just having one year delay on reply and 3 years with the name.

 

You're welcome :celebration:

[uncle fester]

Dear All - Especially Mr VIVI!!! Please note that our website is being named here as a "total junk ripoff site" and "looking fake".

 

Please note that 2k11.co.za is a totally legitimate and registered online business and we do not take kindly to this kind of badmouthing of our business without reason.

 

2k11 Management

 

Lol, your site is JUNK !!!!

[jjjc]

Dear All - Especially Mr VIVI!!! Please note that our website is being named here as a "total junk ripoff site" and "looking fake".

 

Please note that 2k11.co.za is a totally legitimate and registered online business and we do not take kindly to this kind of badmouthing of our business without reason.

 

2k11 Management

 

JUNK site! Very ripoff, much fake look.

 

jjjc Management

[Mean Machine]

Dear All - Especially Mr VIVI!!! Please note that our website is being named here as a "total junk ripoff site" and "looking fake".

 

Please note that 2k11.co.za is a totally legitimate and registered online business and we do not take kindly to this kind of badmouthing of our business without reason.

 

2k11 Management

 

Dear Mr 2k11 MANAGEMENT!!! [sic] Please note that by bumping this frankly ancient thread, you are making MSI look bad.

 

MSI has, unlike whatever small-time business you may be conducting, a full team of lawyers at hand that do take kindly to your bumpings bringing our brand into disrepute.

 

In response to this, we will hand Max to IS and have him beheaded, while we get a 40% kickback on all the profits made by selling the footage to American TV stations. The blood will be on your hands.

[dinos22]

lmfao you guys are ruthless

[uncle fester]

Dear Mr 2k11 MANAGEMENT!!! [sic] Please note that by bumping this frankly ancient thread, you are making MSI look bad.

 

MSI has, unlike whatever small-time business you may be conducting, a full team of lawyers at hand that do take kindly to your bumpings bringing our brand into disrepute.

 

In response to this, we will hand Max to IS and have him beheaded, while we get a 40% kickback on all the profits made by selling the footage to American TV stations. The blood will be on your hands.

 

LMFAO .... fuck where have you been hiding lately mean machine ?

Glad threads like this bring you back.

[Mean Machine]

LMFAO .... bunny where have you been hiding lately mean machine ?

Glad threads like this bring you back.

 

I don't really feel I have so much to add to the usual Hwbot banter, now that I work with notebooks and all. I guess I am around, reading at times, but I don't post much, if anything.

 

Also, it's been about three years since I did some overclocking to speak of, so I don't exactly feel like I know what's going on around here. It was time to step aside and retire, after all I was 22.