This might be the ultimate irony

Submitted by secgeeks on Sun, 30/03/2008 - 18:59.
0
vote

Hi folks,

Today we found what might be the ultimate irony... a spyware product where the home page has been hacked, and is installing someone else's rootkit!

The product is one of those spy-on-your-spouse/kids/employees things that says it's stealthy (in other words, _it's_ supposed to be a rootkit itself), and the home page has a chunk of escaped javascript

that calls out to a Neosploit site that's installing a rootkit.

And it's the new Neosploit too.

We're trying to contact the site owner to tell them, but the "contact me" page crashes.

Oh well... we'll keep trying.

Cheers

Roger


Bookmark/Search this post with:
  • Newskicks
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Facebook
  • Google
  • Yahoo
  • Technorati
  • Icerocket

Trackback URL for this post:

http://www.secgeeks.com/trackback/1633

for appearance sake

Submitted by Anonymous on Wed, 23/04/2008 - 20:49.

can't understand why you bothered to "whiteout" the URL. It only took TEN SECONDS for me to locate the site by googling "keylogging software actively used by concerned parents worried spouses government"

wondering how you happened to find this "seemingly ironic" page? Did you read about it elsewhere (stating it was a hacked site) and that led you to go check it out... or were you researching available keyloggers, or what?

I'm not convinced the site has been 'hacked'. Seems more likely that the perp set it up to APPEAR to be a hack (as an attempt to cover his ass, in the event the site is outed)

Consider:

The site's pages contain GREAT targeted text/keywords to serve as search-engine bait

Looks like a LOT of effort went into creation of the page text, but if you click the link (try to purchase the product purportedly offered for sale) it's a dead end

If there's a "real" site owner, who has developed (and is selling) a real product... and he has put so much effort into crafting the marketing text, why hasn't he been out promoting the product and the site? Okay, so check the inbound links...

You seeing what I'm seeing? Only 21 inbound links.
If all that effort went into a REAL product, there would be hell of a lot more effort expended toward securing inbound links (I'm saying).

So, this guy pushing the rootkit... he's been around the block. He's using this site (the one shown in your screenshot) as just the tip of a tentacle, probably one of many. Shhhh! keep 'em low-profile; stay under the radar.

http://www.robtex.com/dns/spymycomputer.com.html

I'll leave it to you to trek further down the rabbit hole, if you wish. In my opinion, the proof is in the pudding (bogus whois info)
http://www.robtex.com/whois/spymycomputer.com.html