Hacked!

Several sites (most recently ntlworld) have been hacked in a such a way as to cause a JavaScript popup reading:

"You have successfully installed your hard drive for
reformatting. When you restart your computer you must
reinstall your operating system "

If you encounter such a message, you need not do anything - it's completely harmless.

Seems that PocoMail have problems too!

 

Cite?

 

Cite the site? This one! Note the entry for 7 August. Or cite the source? First-hand experience!

 

I got curious and did a groups.google search and came up with:

From: Jamil Karim (jamil.karim@NOSPAM.nwa.com)
Subject: Re: Mystry message
Newsgroups: microsoft.public.windows.inetexplorer.ie6.browser
Date: 2002-08-07 13:23:34 PST


Ron Reddon wrote:
> because I can't even find where it is loading from

I narrowed down the URL to:
http://ds2.idsales.co.uk/hserver/SITE=WEB.NTLWORLD

Which contains the following script:
<script language= "JavaScript ">
alert( "You have succesfully configured your hard
drive for re-formatting. Next time You start
this computer you will need to re-install your
operating system. ");
</script>

The script is obvious, it is just hidden off-site.

=)

Later,
Jamil Karim
Java/J2EE Developer

From: Barbarella (tar_ancalime@hotmail.com)
Subject: Mystry message
Newsgroups: microsoft.public.windows.inetexplorer.ie6.browser
Date: 2002-08-08 08:51:31 PST


I got that "horrifying" message last night too... I have now found out that it was not a virus or somebody trying to hack your computer and you can rest assured that it won't be affecting your system at all.

I am also with NTL World, and I have phoned them earlier on when they confirmed to me that their web site had been defaced with a java script that popped up for anyone who tried to access the NTL World web site at the time the message was there. Basically, their server had been breached, but they took the site down for a while last
night and corrected it, so this "fake" message will not be appearing any more.

I was really panicking last night, backing up everything onto CDs, doing various virus scans (which of course, we know now why, found nothing). Anyway, there you go. Just thought I'd let you know.

BTW, here's a link to the server status of NTL World, where you will see last night's disruption explained...

http://www.ntl-isp.ntl.com/lookup/default.asp