CA’s Web site hacked by malware authors (Redirection to rogue site similar to last year’s Dolphins Stadium attack).

Part of security software vendor CA’s Web site was cracked earlier
this week and was redirecting visitors to a malicious Web site hosted
in China.

Although the problem now appears to have been corrected, cached
versions of some pages in the press section of CA.com show that
earlier this week the site had been redirecting visitors to the
uc8010.com domain, which has been serving malicious software since
late December, according to Marcus Sachs, director of the SANS
Internet Storm Center.

The hack is similar to last year’s attack on the Dolphin Stadium Web
site, which infected visitors looking for information on the Super
Bowl football game, Sachs said. “It’s exactly the same setup,” he
said. “It’s JavaScript that they’ve managed to insert into the title
or the body of the HTML.”

CA itself may not even host the press release section of its site, as
that job is often outsourced to a third party, Sachs said. Often a
misconfigured application server or a Web or database programming
error can give hackers all the opening they need to insert their
malicious code.

“When you outsource, you’ve got to be just as (demanding) about
security as you are with your own site,” Sachs said.

CA representatives could not be reached immediately for comment.

The uc8010.com domain serves attack code that exploits a recently
patched vulnerability in the RealPlayer multimedia software, Sachs
said.

The criminals behind this domain have hacked tens of thousands of Web
pages and inserted code that redirects visitors to the malicious
server, he added.

SANS has posted a note on the uc8010.com issue and recommends that IT
staff block access to the domain. Sachs said another domain, ucmal.com
— also hosted in China — should also be blocked because it is
associated with a similar type of attack.