Super Bowl Stadium Site Hacked - Why Security Matters

Bad guys are not stupid. What they lack in morals they sometimes make up for in creativity and smarts. That’s why they can be so dangerous. Think like a bad guy: If you wanted to find a way to take advantage of a large public event in order to gain fraudulent access to thousands of (or more) individual computers so you could install keystroke logging software and trojan software to allow you to grow your rogue bot network, what would you do?

Well if it was today, maybe you’d think to yourself, “Hey the Super Bowl is this weekend. Let’s set up a fake site and trick people into going there with an email and screw ‘em all over.”

Or, if you were smarter, you’d just take over the server that houses the site for Dolphin Stadium.

If this doesn’t tell you why you should be focused on security, then what does?

The news item is here, and an advisory with a description is here.

The official Web site of Dolphin Stadium, home of Sunday’s Super Bowl XLI, has been hacked and seeded with exploit code targeting two known Windows security flaws.

In the attack, which was discovered by malware hunters at Websense Security Labs, the server hosting the site was breached and a link to a malicious JavaScript file was inserted into the header of the front page of the site. Visitors to the site execute the script, which attempts to exploit the vulnerabilities.

According to Dan Hubbard, senior director, security and technology research at Websense, the malicious site hosting the script has been taken offline by law enforcement officials but the hacked Dolphin Stadium site - which is attracting a lot of Super Bowl-related traffic - is still hosting the malicious JavaScript.

A visitor to the site with an unpatched Windows machine will connect to a remote server registered to a nameserver in China and download a Trojan keylogger/backdoor that gives the attacker “full access to the compromised computer,” Hubbard said.

Oy. What’s it gonna take?

[tags]security, super bowl, hack, security breach, dolphin stadium, greg hughes, dan hubbard[/tags]