Security → foxnews.com infected?

I did, and I also reported it to stopbadware.org as well...

Hopefully it'll be cleaned up by now.

I can confirm there is an infection of the site.

The site is infected through ads and it is these that cause the problem. There can be numerous ads involved, but I have singled out one for sure.

Thank you.

Great, CajunTek. Glad someone took care of that little matter. Thanks.

With the deepest respect for dslreports.com. I've got no problems with not telling who I am, or what connection I have with the reporting. - I work with and am connected with stopbadware.org/www.consumerwebwatch.org - through one of their mutual sites. - We're not here to steal your users, but rather to offer our help when need be.

dslreports has always been one of the best resources of the web, and I hope it stays that way.

That said - I'm working to get to the bottom of this, and have identified the possible advertising partner involved. However, I have not received any response from foxnews.com about the issue. I will be investigating this a little more in depth later and give you all a full disclosure of what has been found.

dslreports.com is the cause for the stopbadware community becoming interested in this issue.

Cometcom1

I'm sure we all have our fingers crossed this can be corrected/caught in good time.

Thanks for your all's help, and nice to met you

I have now managed to obtain a proxy log and a tcp dump of the infection taking place. This should enable us to say what exactly is happening.

I still haven't heard from foxnews.com, if any of you have them on the line, please let them know that I have some of the information required to fix the issue.

Cometcom1

»badwarebusters.org/main/ ··· iew/2772

All this fuss over my laptop almost getting infected.

It seems that the infection emanating from foxnews.com has stopped. I haven't been able to verify any malware from the site today.

If anyone is still experiencing this, please let us know either here at dslreports or through the link fatness provided. (thanks fatness)

I still haven't heard from foxnews but perhaps they can enlighten us later with their response.

Cometcom1

Still infecting... I was just hit.. Its been going on for several days.

I can't imagine Fox will admit any cupability in this. The odds are too great that they'd be sued.

The most that will be said (if anything) is the standard corporate response:
"We did not do it. It is possible that a subcontractor may have done something, but we are not aware of any wrongdoing and we are not responsible for any actions taken by a subcontractor".

Durn (Excuse my french). I had hoped they'd done something to fix it.

Question. Is there any ads that fail to show up for any of you. On my view, I have two ads (denoted by ADVERTISING) on the right vertical bar. Often these are totally blank - If you don't experience these blank spots, then I have a hunch the malware is originating from that location. There's obviously some intelligence involved in the distribution.

I'm not surprised in the least to see DIRECTI's involvement in this. They have been implicated in a huge number of rogue security software scams.

They continually allow the cybercriminals behind these fraudware sites to register new domains, all the while claiming they are taking action against them by shutting down existing ones.

Be advised that there is a high probability that the advertiser serving up this malware may be rotating geographic regional adds, either based on the visitors IP, or existing cookies. The exposure may rotate by region depending on the add criteria, and not everyone will "see" the same rotation. I saw earlier reports from several days prior to my original post listing the infection, that pronounced foxnews "clean". I would be hesitant to assume from the absence of the malware over any time period that the issue has been resolved, without some confirmation from the offending advertiser.

I suspect that this is a well organized infection vector that is designed for variable regional exposure, in order to preserve the operation and obfuscate the origin.

While I understand your reluctance to publish your analysis data and identify the advertising source, I am interested in a relevant issue. Have you determined if the source is a direct add link, or if it appears to be a "legit" add link compromised by some form of injection?.

The reason I ask, is that it is already known and verified that some of the criminals that are pumping this malware are using paid sponsor adds to promote the infection. A previous fake antivirus thread identified a small time operative and affiliate recruiter residing in Moscow, Russia with the alias "Cactus" was using paid sponsor adds on Yahoo and others to promote the malware to consumers in this thread: »[Scam] Real-av.org - Antivirus2009 malware takeover and this specific post. »Re: [Scam] Real-av.org - Antivirus2009 malware takeover

An unacceptable weak link in the internet advertising industry, which has been discussed on numerous occasions in that forum, is the lack of vetting during the submission process. While advertisers may review keywords and relevant links for acceptability, they routinely do not take simple steps to validate the submitter against the form of payment used. I have recorded and documented cyber criminals using stolen card data to successfully open and use Google adsense accounts. The success was dependent on an approval of the charge submitted against the stolen card.

I hope that you will publish the reference data for review even if no response is forthcoming. Even if the data is inconclusive and lacks confirmation from the source, it should be published for others to evaluate.

This vector is not a one time event, neither do I believe that foxnews.com is the only site that is subject to this issue.

Two of the many entities that are responsible for this malware becoming an epidemic, are the support services repeatedly obtained from the global financial card processing and banking system, and the services of the internet advertising industry. Nether one, but especially the banking system are doing reasonable due diligence wit respect to this criminal activity.

MGD

I concur with your assessment MGD.

I've seen this happen here in my country on a local scale as well. "Our" local infection was hosted in China, but spread out on all Danish news sites.

This community has continued to report this infection even after I thought it was over.

Foxnews is still infected - unfortunately.

I went to foxnews.com today and the browser shut down automatically. I then got a message saying my computer was infected.

I closed the dialog box and it brought me to a website designed to look like a virus scan was running on my computer. I closed down the browser.

Eset nod32 did not detect anything but it's probably because I did not allow anything to be downloaded to my system.

You might want to run some tools to make sure:

»Re: foxnews.com infected?

Hi,

I have been on foxnews.com twice this weekend, and both times I saw suspicious behavior. One time Firefox blocked access to a site called antimalware-scannerv2.com. However today Firefox did not block access to a site called onlinevirusbusterv2.com. After I started reading an article on foxnews.com for a few seconds, my browser was redirected to a fake av site that "performed" a bogus virus scan on my machine. I fear most people fall for this stuff and end up installing the trojan. At this point, I feel it is unsafe to go to foxnews.com.

Seriously, my NoScript and AdBlocker take care of the issues. If I need to allow scripting, I do so only for their home domain. It takes care of the malware issue.

I was just going to ask that question, does AdBlock and/or NoScript prevent this malware? Are you running both, or just one? I tried both a while back and found them extremely annoying, blocking things that shouldn't be blocked like videos, etc. It was torture trying to weed out the bad stuff from the good to get things working.

I also use a simple Firefox add on called QuickJava that allows me to block both java and java scripting on the fly as I see fit on a site per site basis, although I'm not sure it would work with this issue as there are multiple domains involved, not just the home domain.

I run both.

I agree, it's a pain until you learn where the media is usually stored. thanks for the quickjava mention - I'll have to try that.

Just to confirm. Still being targeted here as well. Fake antivirus type redirection.

As I expected, there's likely a reinfection timer that checks when an IP was last infected to avoid reinfection over at least 24 hours. - My tests seem to indicate that this is not done with cookies.

I still have no problems on FoxNews.com. I am using Firefox with NoScript and FlashBlock and I use a hosts file to block ads as well.

Nothing against foxnews - it's their advertising that is acting up and spreading the malware. Likely without them even realizing this is going on.

I've now established contact with foxnews and they are looking into this very seriously.

Cometcom1

I left my Home Laptop on over night on Foxnews.com (Nothing Else open) and my Laptop Antivirus (Symantec) Picked Up Bloodhound.Exploit. Also, a user in my office was slammed with 3 different maleware issues (She claimed came from Foxnews) and after i cleaned them all I installed the latest Symantec EndPoint Protection and went back to Foxnews.com and sure enough it picked up 3 different maleware trojans. It stopped all three and I then removed any IE7 Add-Ons and went back to the site and nothing happened. There is something about that site.

Maybe this will provide more of a push for Fox News to deal with this problem: »FoxNews.com Serving Up Infected Ads? [212] comments