Researchers reveal OpUSA attackers' MO
Posted on 16 May 2013.
Anonymous' highly publicized Operation USA has not been the resounding success they expected it to be.

Sure, the number of sites sporting a page containing messages from the attackers was big, but they mostly belonged to small businesses and individuals, and some of them not even to U.S. citizens and organizations.

Also, a considerable quantity of the purportedly stolen and leaked information and credentials have been discovered to have been stolen in previous attacks, bogus, or inaccurate because it was not up to date.

By analyzing information provided by the company's Smart Protection Network and the attackers' pastebins, Trend Micro researchers have discovered the prevalent modus operandi of the attackers.

"We first looked at the sites that hackers had compromised as part of the OpUSA campaign. It quickly became apparent that there were patterns in the compromised URLs: the attackers had frequently uploaded files with names like islam.php, muslim.htm, jihad.htm, and usa.htm to the compromised site. A legitimate visitor would never visit or see these particular URLs, as they were completely separate from the main site and, in effect, 'hidden,'" they explained.

This allowed the hackers to compromise sites before the actual start of the operation, but also kept the compromise hidden from most sites' owners until the right time.

The researchers also noted that the attackers visited these pages in the day or two before the official start of the campaign, likely to check whether the pages have been discovered and removed.

Unfortunately, they have been clever and used compromised machines as proxies to access those pages, so that the IP address doesn't lead to them.


Patching: The least understood line of defense

Posted on 29 August 2014.  |  How many end users, indeed how many IT pros, truly get patching? Sure, many of us see Windows install updates when we shut down our PC and think all is well. Itís not.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.


Tue, Sep 2nd