Malicious Website: Super Bowl XLI / Dolphin Stadium

Websense Security Labs ^ | Feb. 2, 2007 | Websense Security Labs

[snarkpup]

Websense® Security Labs™ has discovered that the official website of Dolphin Stadium has been compromised with malicious code. The Dolphin Stadium is currently experiencing a large number of visitors, as it is the home of Sunday's Super Bowl XLI. The site is linked from numerous official Super Bowl websites and various Super Bowl-related search terms return links to the site.

[snarkpup]

Haven't seen this corroborated elsewhere yet; but this is another reason why I always keep my security settings near maximum.

The article itself says this is another example of hostile scripting. This is somewhat ironic since their web site is full of it. However, the article reads fine with scripting disabled.

[snarkpup]

This is somewhat ironic since their web site is full of it.

I don't know if Websense's scripting is hostile, just that it's there and seems to be unnecessary.

[snarkpup]

The stadium says it's fixed now, but that "an unknown number of visitors were affected":

http://www.scmagazine.com/uk/news/article/630637/just-two-days-super-bowl-xli-hackers-use-dolphin-stadium-site-exploit-pcs/

[D-fendr]

The script attempts to exploit two previously-fixed vulnerabilities, one of which is a bug in vector markup language (VML) that was patched Jan. 9 by Microsoft.

Live and die by the patch.

[snarkpup]

More details; and it may not be over yet:

http://blogs.chron.com/techblog/archives/2007/02/offensive_hacking_at_the_super_bowl_1.html

"The site has since been cleaned up, but ZDNet blogger Ryan Naraine says another version of the Web address which is supposed to direct to the main site has now been compromised, and it's sending users to a page with malicious code."

[HAL9000]

From zdnet -

Updated #2: February 2, 2007 @ 5:13 pm] All the affected Miami Dolphins sites (see Alexa traffic data) have now been disinfected but there is evidence that hundreds of other sites have been hijacked and rigged with the malicious JavaScript code. I've confirmed that the one-line code has been planted on an internal page of the U.S. government's Centers for Disease Control and Prevention Health Marketing site.