{"id":680714,"date":"2010-03-03T01:42:59","date_gmt":"2010-03-03T06:42:59","guid":{"rendered":"http:\/\/www.szone.us\/f85\/malicious-web-site-malicious-code-bbs-sougou-compromised-40260\/"},"modified":"2010-03-03T01:42:59","modified_gmt":"2010-03-03T06:42:59","slug":"malicious-web-site-malicious-code-bbs-of-sougou-compromised","status":"publish","type":"post","link":"https:\/\/mereja.com\/index\/680714","title":{"rendered":"Malicious Web Site \/ Malicious Code: BBS of Sougou Compromised"},"content":{"rendered":"<div>03.01.10 04:00 PM<\/p>\n<p>Websense\u00ae Security Labs? ThreatSeeker? Network has discovered that the BBS of Sougou has been compromised.<\/p>\n<p> The Sougou BBS home page and other pages on the site have been injected with a malicious script. The script creates an IFrame that redirects users to an exploit site: a 5-day old domain at [snip]ow.info. The latter performs some checks before delivering the exploits, in order to subvert any analysis attempts. <\/p>\n<p> At the time of writing this alert, the BBS of Sougou is still injected with the malicious script, but the exploit site is down. This could change at any moment. <\/p>\n<p> This is the injected code in the home page and its contents: <\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/securitylabs.websense.com\/content\/Assets\/AlertMedia\/BBS_of_Sougou_Compromised_1.png?w=780\" border=\"0\" alt=\"\" \/> <\/p>\n<p> <img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/securitylabs.websense.com\/content\/Assets\/AlertMedia\/BBS_of_Sougou_Compromised_2.png?w=780\" border=\"0\" alt=\"\" \/> <\/p>\n<p>Here is the exploit page: <\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" src=\"https:\/\/i0.wp.com\/securitylabs.websense.com\/content\/Assets\/AlertMedia\/BBS_of_Sougou_Compromised_3.png?w=780\" border=\"0\" alt=\"\" \/> <\/p>\n<p>Websense Messaging and Websense Web Security customers are protected against this attack. <\/p>\n<p><a href=\"http:\/\/securitylabs.websense.com\/content\/Alerts\/3574.aspx\" >http:\/\/securitylabs.websense.com\/con&#8230;erts\/3574.aspx<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>03.01.10 04:00 PM Websense\u00ae Security Labs? ThreatSeeker? Network has discovered that the BBS of Sougou has been compromised. The Sougou BBS home page and other pages on the site have been injected with a malicious script. The script creates an IFrame that redirects users to an exploit site: a 5-day old domain at [snip]ow.info. The [&hellip;]<\/p>\n","protected":false},"author":3076,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4821],"tags":[],"class_list":["post-680714","post","type-post","status-publish","format-standard","hentry","category-news"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p9NivD-2R5g","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/posts\/680714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/users\/3076"}],"replies":[{"embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/comments?post=680714"}],"version-history":[{"count":0,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/posts\/680714\/revisions"}],"wp:attachment":[{"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/media?parent=680714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/categories?post=680714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mereja.com\/index\/wp-json\/wp\/v2\/tags?post=680714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}