Large-scale SQL injection affects many sites, redirects to scam AV - Hot off the Press

Views: 881,524,834
Time: 2021-02-27 09:34:58 AM

7 users online: HaruMKT, orka-bln, PhantasyReal, Rilla Roo, SF - The Dark Warrior, singlepat, TS_N - Guests: 41 - Bots: 83

Users: 49,363 (2,453 active)
Latest: jskyebell

Tip: ALWAYS test anything that you've made before submitting it to SMW Central.

Not logged in.

Large-scale SQL injection affects many sites, redirects to scam AV

Forum Index - Sunken Ghost Ship - Forum Graveyard - Hot off the Press - Large-scale SQL injection affects many sites, redirects to scam AV

Pages:

Link

Counterfeit

What does your soul look like?

Posts: 1336/4407
Since: 2007-09-03 05:32:41 PM
Location: Antarctica
Pronouns: She/Her

Last seen: 2 months and 25 days ago

Link
Posted on 2011-04-04 01:33:05 AM

I'm surprised there's no thread about this already.

The "LizaMoon" attack has been loose since March 29. It works by using SQL injection to stick a redirect onto a website that brings the end user to a scareware site, trying to make the user think he's been affected with viruses. The site encourages him to install a rogue antivirus called "Windows Stability Center" and then purchase it.

Relevant news article
Websense, currently tracking LizaMoon
Video for the curious. This happens when you go to an affected site and use the fake antivirus.
How to remove Windows Stability Center

Good news is, many of the sites known to be infected are relatively obscure, and while a moderately net-savvy person probably wouldn't need to worry, the info is good to spread so someone prone to panic or who just doesn't know won't mistakenly fall for the scam. The Firefox addon "NoScript" is probably a good idea if you don't want the redirect annoyance, in case you do visit an affected website.

WSC itself is a bit sloppy in its aim to look authentic; the discrepancies in the spelling of "license" are kind of humorous.

Just look above you...
If it's something that can be stopped, then just try to stop it!

Aja
Former Administrator

I still exist

Posts: 1278/6871
Since: 2010-01-16 09:35:30 PM
Location: Mexico
Pronouns: She/Her

Last seen: 11 hours, 13 minutes and 41 seconds ago

Link
Posted on 2011-04-09 12:08:28 AM

I never heard of this before.

I just watched the video. So basicaly it does nothing but tell you to purchase a fake anti-virus? That's a verry pathetic way to make money in my opinion. I just hope I won't have to deal with that thing.

Ersanio

INC $19 Mario

Lurker extraordinaire

Posts: 6016/9260
Since: 2007-08-20 04:27:16 PM
Location: super mario world central

Last seen: 11 hours, 35 minutes and 19 seconds ago

Link
Posted on 2011-04-09 11:48:23 PM | Last edited 2011-04-09 11:50:50 PM by Ersanio

It actually infected a site I've been visiting regularly. When you get redirected and an alert box appears, press cancel/no/whatever button to decline stuff (and stay safe). If you press OK/yes you get a fake, fancy virus scanning page. If you don't want to get infected, don't click anything within that page. If you do, your virus scanner will complain (mine did).

Windows 7 users should be able to figure out that the virus scanning page is fake. Like, a windows XP interface in windows 7 in a browser of choice DOES look suspicious.

--------------------
My blog. I could post stuff now and then

The Secret Exit
Fire Nipper Plant

Posts: 182/1518
Since: 2011-01-29 04:18:24 PM
Location: Kentucky

Last seen: 2 years, 2 months and 13 days ago

Link
Posted on 2011-04-10 12:10:36 AM

Actually, just kill the process through Task Manager. One can't trust rogueware to be even half truthful.

Celarix | [email protected] | Avatar by Uhrix

mockingod

ᕕ( ᐛ )ᕗ

Posts: 3511/4738
Since: 2009-08-12 04:59:08 AM
Location: Seattle, Washington

Last seen: 8 months and 5 days ago

Link
Posted on 2011-04-11 07:13:30 AM

Originally posted by Ersanio

Windows 7 users should be able to figure out that the virus scanning page is fake. Like, a windows XP interface in windows 7 in a browser of choice DOES look suspicious.

I was browsing a site through my phone, and that popped up. I was laughing so hard.

ElecRenzor
Pop-Tart Cat

Posts: 11/73
Since: 2011-04-10 04:08:07 AM
Location: S.S. Teacup

Last seen: 7 months and 8 days ago

Link
Posted on 2011-04-14 07:30:30 PM

I've been plagued with this problem on a few sites, but the video ones by far are the worst for me they make random lag moments even more annoying.

Troopa
Pop-Tart Cat

Posts: 3087/3120
Since: 2007-08-24 04:15:34 AM

Last seen: 5 years, 6 months and 17 days ago

Link
Posted on 2011-04-16 01:00:12 PM

This reminds me: What plugin for ff besides noscript can I use to disable redirects and prevent something like this from happening?

--------------------
Your layout has been removed.

leictreon

Semi-Retired Veteran
Ralsei

Life's meaningless, it's up to you to give it any meaning at all.

Posts: 4934/6803
Since: 2008-07-13 07:22:09 PM
Location: somewhere over the rainbow

Last seen: 1 month and 2 days ago

Link
Posted on 2011-04-16 04:22:55 PM

I think i am one of the few who hardly care about this, because it doesn't affect any site i visit.

dah

--------------------

they say... i forgot

Jeorge535
Posts: 3507/4425
Since: 2009-02-21 09:56:04 AM

Last seen: 7 years, 10 months and 20 days ago

Link
Posted on 2011-04-18 09:54:49 PM

Originally posted by Ersanio

I just this minute came across that. It's pretty stupid how it's got a Windows XP interface when many computers run on Windows 7, it just makes it more obvious that it's fake.

Pages:

Link

Forum Index - Sunken Ghost Ship - Forum Graveyard - Hot off the Press - Large-scale SQL injection affects many sites, redirects to scam AV


	Main Page News Forums Member List Rules F.A.Q. Staff Discord Register Login SMW Hacks SM64 Hacks YI Hacks Tools Documents Savebase™ BRR Samples SMW Graphics SMW Music SMW Blocks SMW Sprites SMW Patches SMW UberASM SMW ROM Map SMW RAM Map SMW Hijacks SM64 RAM Map SM64 ROM Map SM64 Music SM64 Textures YI SRAM Map YI RAM Map YI ROM Map YI Music YI Patches YI SPASM

Follow Us On

Affiliates