MyCity » Ambulanta -> MyCity Laboratorija » Snooping on Chinese students?

Snooping on Chinese students?

Napisano na dan: 11.1.2012

Snooping on Chinese students?
Sledeća strana Pagination

Idi na vrh

Poslao: 11 Jan 2012 21:04
Idi na vrh
offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Citat:Between the holidays I found a very simple but digitally signed malcode. It basically does one single thing: It overwrites the hosts file. The modification is as follows:

Citat:175.41.21.11 www.chsi.com.cn

The hosts file modification has the effect of overriding any DNS queries for chsi.com.cn so that it points to a different IP than the official one. The site chsi.com.cn seems to be a student information portal, “China Higher Education Student Information Network”.

By redirecting the address to a different IP, attackers are able to present users with altered web content or perform man-in-the-middle attacks. The purpose of this against a student site is up for speculation.

The digital signature attached to the file is quite recent, Dec. 28th, 2011. The certificate belongs to 北京火鸟网络科技有限责任公司 (Google translated to “Beijing Firebird Network Technology Co., Ltd.”). We’ve been in contact with Thawte and have gotten confirmation that this certificate is being revoked.

Source: http://blogs.norman.com/2012/malware-detection-tea.....e-students




Knjigu u šake, no bad western p0rn for you. Razz



Registruj se da bi učestvovao u diskusiji. Registrovanim korisnicima se NE prikazuju reklame unutar poruka.

MyCity » Ambulanta -> MyCity Laboratorija » Snooping on Chinese students?

Ko je trenutno na forumu
 

Ukupno su 1240 korisnika na forumu :: 56 registrovanih, 8 sakrivenih i 1176 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 8u47, airsuba, Alibaba1981, amonsrb, Apok, aramis s, bagor10, Bobrock1, bokisha253, Boris Bosiljčić, celik, cemix, cifra, dankisha, Darko001, darkstar101, dejina811, djordje92sm, dolinalima, flash12, Georgius, GORDI, goxin, havoc995, HrcAk47, ILGromovnik, ivicasimo, JOntra, kikisp, kjkszpj, Koridor, KOV, krkalon, Krvava Devetka, kybonacci, Litostroton, LUDI, MB120mm, mercedesamg, Mercury, mikrimaus, mile23, moldway, nextyamb, procesor, raso7, Reinhardt, Rogan33, Shinobi, slonic_tonic, vathra, wizzardone, wolverined4, Zaledjeni, zixmix, 1107