We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

CA website attacked by malware authors

Security surfers redirected to malware site

Security software vendor CA's website was hacked last week. Malware writers hacked into part of CA.com and redirected visitors to a malicious website hosted in China.

The problem now appears to have been corrected. However, cached versions of some pages in the press section of CA.com show that earlier this week the site had been redirecting visitors to the uc8010.com domain, which has been serving malicious software since late December, according to Marcus Sachs, director of the SANS Internet Storm Center.

Visit Security Advisor for the latest PC security news, reviews, tips and tricks.

The hack is similar to last year's attack on the Dolphin Stadium website, which infected visitors looking for information on the Super Bowl American football game, Sachs said.

"It's exactly the same setup," he said. "It's JavaScript that they've managed to insert into the title or the body of the HTML."

CA itself may not even host the press release section of its site, as that job is often outsourced to a third party, Sachs said. Often a misconfigured application server or a web or database programming error can give hackers all the opening they need to insert their malicious code.

"When you outsource, you've got to be just as (demanding) about security as you are with your own site," Sachs said.

CA representatives could not be reached immediately for comment.

The uc8010.com domain serves attack code that exploits a recently patched vulnerability in the RealPlayer multimedia software, Sachs said.

The criminals behind this domain have hacked tens of thousands of web pages and inserted code that redirects visitors to the malicious server, he added.

SANS has posted a note on the uc8010.com issue and recommends that IT staff block access to the domain. Sachs said another domain, ucmal.com - also hosted in China - should also be blocked because it is associated with a similar type of attack.

IDG UK Sites

6 best gaming PCs 2015: What's the best gaming PC you can buy in the UK?

IDG UK Sites

Three of the most expensive Limited Edition games ever made: Who's buying a $1,000,000 game?

IDG UK Sites

The future of Microsoft Surface: What to expect from the Surface Pro 4

IDG UK Sites

Best Mac: Apple Mac buyers guide for 2015: iMac, MacBook, MacBook Air, MacBook Pro, Mac mini and...