False Positive: php.net Malware Alert
Update: Barracuda posted a more detailed analysis and packet capture showing that php.net may indeed have been compromissed and delivered a malicious flash file: http://barracudalabs.com/2013/10/php-net-compromise/ (thx David for pointing to this)
Earlier today, Google had php.net added to its list of malicious sites. The listing was the result of a false positive triggered by an obfuscated javascript file that is a legitimate part of the php.net site. At this point, the false positive appears to be resolved.
Sadly, Google is notoriously slow in removing false positives like this. It helps if the site's administrator is signed up with Google Webmaster tools. In this case, a request for review can be filed via webmaster tools, and the administrator will be notified via e-mail if the site is added to the blocklist.
For more details, see:
https://productforums.google.com/forum/#!topic/webmasters/puLmvjtK0m8%5B1-25-false%5D
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Are you a small business that experienced a DoS attack?
We are looking for small "brick and mortar" companies that got affected by a DoS attack agains their website. Recently, we heard from a couple of non-internet local businesses whose websites experienced substantial DoS attacks, and we would like to see if this was just an "outlier" or a new trend.
Pleaes use our contact form: https://isc.sans.edu/contact.html
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter
Comments