Safari Hijacking??!!

Question

Level 4

1,355 points

Safari Hijacking??!!

Hi, First point, let's get this out of the way: I know there are neither virus nor malware in the wild for macs.

Now, to the matter: Today, my Safari, Firefox and Mail app were hijacked several times, and were always redirected to this page: www.register.4less.com

Always that I typed an ordinary http address (let's say: www.elnorte.com) in the address bar, I ended up in a site that purportedly belonged to the address I typed (in the address bar said the address I typed), but on the body, there was an image with the logo of register.4less.com, and the text: "Welcome to the future hosting of "www.[whateverityped].com" It was the same on FF and Safari.

It all started when the Mail app warned me that a computer with a certificate issued to "register.4less.com" was pretending to be pop.gmail.com. I obviously cancelled the process, thinking the gmail server was compromised. I then experienced problems connecting with ANY app in my computer, even the RSS reader widget crashed (and when it crashed it couldn't connect to apple for sending the report).

I made several transactions trough an https server (my bank) without any problems, only somewhat slower than the average. After this, any other website which were not https would give me the message I've explained before. I know I shouldn't have logged in to my bank, but at that moment I didn't suspected anything.

Now, some more important information. I live in Mexico City, but right now I'm on vacation on my parent's house in my place of Birth: Monterrey, México. I have a cousin living also in Monterrey, which has refered to me he had encountered this problem with safari before and only in http sites. He told me also that https sites didn't have any problem (ebay and amazon sign in pages, e.g.). He uses the same ISP my parents use. In México city I have another ISP, and have never before had this problem. Right now my brothers are out of home, so I can not ask them if they have had this problem before, altough none of them uses a Mac.

Of course I always have my Mac's firewall on. I also don't have any sharing enabled (neither windows nor personal file sharing).

When I empty the cache this problem goes away for a few minutes before returning (that's how I'm writing this).

I have the pop-up blocker on, and while typing this I changed the cookies to "Only to sites you navigate to", and deleted all of the cookies already installed. This didn't prevented the problem from happening again.

Now guys, help me out here with these Questions:

1. What should I do??
2. What happened?? Could it be that the ISP have been compromised?, or is it my computer? I don't think it is my computer, I've searched the entire HD searching for anything remotely likely to register.4less.com and I didn't found anything. But right now I'm a little scared.

iBook G4 12, 1.33 GHz, 60 GB HD, 1 GB RAM, BT, Zire 72, 2 iPods Mini, Mac OS X (10.4.5), . "Nacer es comenzar a morir" Théophile Gautier

Posted on Jun 13, 2006 6:16 PM

Reply

Answer 1

TildeBee

Level 7

31,923 points

Jun 13, 2006 8:00 PM in response to CD5VS

CDSVS --
Go through your cookies --
Safari Main Menu, top left.
Go to Preferences
Then Security Tab
Down where the box says "Show Cookies"
Delete any from register.4less.

See if there's any improvement.
If not, then go back to the same place
and delete ALL cookies.

Hope this helps.

Reply

Answer 2

CD5VS Author

Level 4

1,355 points

Jun 13, 2006 10:22 PM in response to TildeBee

Thankyou Bee, I've already done that, and didn't find any cookie related to that site. I opted for reset ALL Safari. That didn't work. I reset 3 times my machine, the last time, it seemed to have worked. At least It's been more than 3 hours trouble-free.

Still What the !¡#$%%/ Happened??????

Reply

Answer 3

Jun 13, 2006 10:45 PM in response to CD5VS

One last note to add to BEE's Always remember to restart your computer for changes to take affect.
I find that running 3 pieces of software help eliminate this type of problem. I use them once a week need to or not.
It will keep all that stuff out of your computer.
Macjanitor.
http://personalpages.tds.net/~brian_hill/downloads.html
Cache Out X.
http://www.versiontracker.com/dyn/moreinfo/macosx/14850
Onyx.
http://www.versiontracker.com/dyn/moreinfo/macosx/20070
These will work, one short note of caution, be sure to be careful because Onyx will delete all your bookmarks if you are not careful, be sure to read all it does.
Cheers Don

Reply

Answer 4

CD5VS Author

Level 4

1,355 points

Jun 17, 2006 8:52 AM in response to CD5VS

An update: This has not happened again after all I described on my original post. However, the fact that it happened a whole afternoon still puzles me.

Any ideas on what happened here?

Thanks for your advice, I forgot to tell that I regularly run the cron scripts and delete all the cookies I do not want, plus repair permissions before and after installing anything.

Reply

Answer 5

Jun 17, 2006 9:09 AM in response to CD5VS

Here is also an update for you.
It may be that you were expieriancing (PLISHING) never, ever ever click on any link from any site directing you to another. close out and always log in directly to that site to do any buisness of any kind.
Especially PAYPAL or a BANK.
I suggest if you have been duped by these folks go to your bank's site or paypal or any that you use and change your PASSWORD imediately. These people are busy all over the world comprimising and stealing information and emptying peoples accounts.
I recieve about 3 of these bogus e-mails a week.
(ALWAYS, ALWAYS LOG IN DIRECTLY) NEVER EVER EVER USE A LINK.
Don

Reply

Answer 6

CD5VS Author

Level 4

1,355 points

Jun 17, 2006 11:08 AM in response to Donald Morgan

Donald, thankyou for your good intentions, but Man you misunderstood my post!

I think you and I are talking very different things. I DID NOT fall into a phishing (it's not plishing) scam. Sorry if I was not clear, I just wanted to know what could be the reason that all my internet traffic were redirected, on every application I used. For what I've learned, it could be my parents ISP DNS server was compromised.

Thanks anyway for your time.

Reply

Answer 7

Tom Graves

Level 7

20,627 points

Jun 17, 2006 11:30 AM in response to CD5VS

Are you redirected if you use a different browser, such as Firefox or Camino?

You could also try Safari in a new user account. To create a new account, open System Preferences and click on Accounts. You may have to click on the padlock and give your admin name and password to create an account. Click on the plus sign in the lower right corner to create the new account. I see no reason to give it a password. You can delete this account later using using the minus key, although I have kept my second account to use for testing (the user folder only takes up 32 kb).

The thought that the problem might lie at the isp level did occur to me. Can you take your iBook elsewhere (a friend's house - someone with a different isp) to see what happens?

Reply

Answer 8

CD5VS Author

Level 4

1,355 points

Jun 17, 2006 11:51 AM in response to Tom Graves

Thanks Tom, as I stated before, the Hijacking ocurred on every app I tried, and not only in browsers (Safari, FF, Opera, Mail, widgets, rss readers, etcétera).

You give me some good ideas (like trying another user account, and going to a friend's house). I'll try them if this ever happens again. BEcause now it's almost three days and this has not happened again, therefore I do not see the point on trying them now, it won't teach me anything.

Thanks again.

Reply

Answer 9

Tom Graves

Level 7

20,627 points

Jun 17, 2006 12:09 PM in response to CD5VS

I'm glad to hear things have been normal for the last few days. If you have changed nothing, that leads me to further suspect there was a problem on the isp end which, hopefully, has been fixed.

Cross your fingers and knock on wood. ;-)>

Reply

Answer 10

CD5VS Author

Level 4

1,355 points

Sep 3, 2006 7:28 AM in response to CD5VS

Well, this never happened again. The corollary is that it must have been the ISP that was compromised or that it unintentionally used some sort of redirecting-blocking software.

Still, this is only theoretic.

Reply

Answer 11

Sep 3, 2006 12:23 PM in response to CD5VS

I just saw this on the DHS web site.

Servers are frequently hacked; Even on Mitnick's ISP server (HostedHere).
-==============================================
August 21, CNET News — Kevin Mitnick Website hacked.

Instead of the usual description of Kevin Mitnick, his consulting services and books, the famed hacker's Website on Sunday, August 20, displayed a vulgar message. Online vandals, apparently operating from Pakistan, broke into the computer hosting Mitnick's Website on Sunday and replaced his front page with one of their own. As a result, four Web addresses belonging to Mitnick, including KevinMitnick.com and MitnickSecurity.com, displayed an explicit message on Mitnick and hacking. The attackers gained complete control over the server that hosts his site as well as others at hosting provider Hostedhere, Mitnick said. Website defacements still occur often, but they have become less high profile in recent years as other, financially motivated threats take the spotlight.

Screen shot: http://www.zone-h.org/content/view/14073/31
Source: http://news.com.com/KevinMitnick+Web+sitehacked/2100-7349_3-6108032.html?tag=nefd.top

Reply

Answer 12

bjprc

Level 1

23 points

Sep 10, 2006 7:41 PM in response to CD5VS

Here in Beijing, same problem, happens on Firefox as well as Netscape Browser 7.1. Deleting cookies, history, cache and all plus restart does not help. Especially in Netscape cookie settings set to ask every time cookie is set. When hijacking occurs, happens no any cookie setting is requested. Exhaustive tests done on the iMAC as well as PC connected to same router connected to same ADSL line did not produce any suspicious malware/spyware. Other ADSL line in our office till now does not have the problem. So, is it possible the ISP has the problem but only on some of their equipment? We are now trying to see if the problem occurs on an old PowerBook (OS 9) connected to the same router/ADSL. Not confirmed 100% but it seems we go around the problem when hijacking occurs without restarting Firefox but simply activating TOR (installed on the iMAC - plus Privoxy). Maybe this confirms it is the ISP?

Reply

Answer 13

CD5VS Author

Level 4

1,355 points

Sep 11, 2006 10:08 AM in response to bjprc

I've never used TOR-Vitalia-Privoxy package, but from what I can read on the net, it seems to anonimize your DNS requests and to avoid the "kidnapping" of the IP traffic.

I'm not sure if the resolution of the "kidnap" by using these tools, means that the problem is on the ISP side. Maybe someone else with more experience on networking can give us a hand.

Reply

Answer 14

bjprc

Level 1

23 points

Sep 12, 2006 7:31 PM in response to CD5VS

Problem continues and is getting worse. Strangely, till now the PowerBook (OS9) connected to the same ADSL/router is not affected - yet. I installed Little Snitch 1.2.3 (now running in demo mode) and it does detect Firefox trying to go to funny sites instead of the right one. After denying the connection in Little Snitch, Firefox does only work with TOR and otherwise a restart is needed. Strange. Overall I still think the problem is with the ISP but I still feel uneasy...

Reply

Answer 15

CD5VS Author

Level 4

1,355 points

Sep 17, 2006 7:37 AM in response to bjprc

The fact that Littlesnitch prevents FF from working at all (meaning that ANY web address is redirected to another site) and that TOR restores the working, make me think that the problem is on the DNS assignation... and, once again, I would think the problem then is not on the ISP, however of this I can't be sure.

In the last city I was living, there was an ISP (strangely the same that I was using when my DNS assignations were kidnapped) which had a security problem with macs about 6-8 years ago; this is, when you used a mac with this ISP, if you had file sharing turned on, any other Mac could access your files, even if it was not on your local network, but only using the same ISP.

Maybe this same principle applies to other ISP's, are the Macs and PCs not using the same resources on the ISP?

A last thought, have you tried not using web addresses, but DNS numbers to connect to some sites and watching if these attempts are also redirected??? What about other apps, like mail, or widgets? Do they work?

Reply