See: http://killmalware.com/openbootcamp.com/# 7 malicious pages found!
None detected here: https://www.virustotal.com/nl/url/0dec500d0cdefef2f12c4f3adae6c48ead8fce6d1de8f6decb00a4f791ae6db6/analysis/1431781956/
Quttera detects: index.html
Severity: Malicious
Reason: Detected reference to blacklisted domain
Details: Detected reference to malicious blacklisted domain -stats.hosting24.com
File size[byte]: 1957
File type: HTML
Page/File MD5: 4D7578598FAEEFB702E32A09B73F7F5D
Scan duration[sec]: 0.033000
Sucuri’s detect: Malware Detected Critical
ISSUE DETECTED DEFINITION INFECTED URL
Defacement MW:DEFACED:01 htxp://www.openbootcamp.com/
Defacement MW:DEFACED:01 htxp://www.openbootcamp.com/404javascript.js
Web site defaced. Details: http://sucuri.net/malware/entry/MW:DEFACED:01
http://openbootcamp.com
Detected libraries:
jquery - 1.8.3 : (active1) htxp://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
(active) - the library was also found to be active by running code
1 vulnerable library detected - jQuery( strInput ) cannot reliably differentiate selectors from HTML.
jQuery versions vulnerable to $(“#”) and $(“element[attribute=‘
’”)
Quick info about -openbootcamp.com ( The website is not blacklisted and looks safe to use. The domain is NOT BANNED from Google Adsense program! )
Hacked By 1SMARTLORD D NET_ERROR
The requested URL returned error: 404 Not Found
Suspicion of Defacement
/html hacked by 1smartlord d net_error <font colo…
IDS alert for “GPL ATTACK_RESPONSE id check returned root” here: http://urlquery.net/report.php?id=1431782861044
alienvault:/etc/snort/rules# grep 498 attack-responses.rules
alert ip any any → any any (msg:“ATTACK-RESPONSES id check returned root”; content:“uid=0|28|root|29|”; metadata:policy balanced-ips drop, policy security-ips drop; classtype:bad-unknown; sid:498; rev:7;)
alienvault:/etc/suricata/rules# grep 498 emerging_pro-attack_response.rules
alert ip any any → any any (msg:“GPL ATTACK_RESPONSE id check returned root”; content:“uid=0|28|root|29|”; classtype:bad-unknown; sid:2100498; rev:7;)
Both SIDs come under the 1001 data source ID. Suricata /w Emerging Threats Pro.
polonus (volunteer website security analyst and website error-hunter)