That’s right, the television network CBS had their website hacked using the popular iframe method and was actually used for a period of time to distribute malware to it’s visitors. I am not for sure how many visitors CBS has on a daily basis but I am pretty sure it’s probably high volume.
One of the popular features on CBS’s website among visitors is the ability to view missed episodes of their favorite shows like The Unit, CSI: Miami, and NCIS. Below is a report I found on Techworld regarding the attack…
TV network CBS has become the latest big name to have it website used to host malware, a security company has reported.
It appears that Russian malware distributors were able to launch another iFrame attack on a sub-domain of the cbs.com site so that it was serving remote malware to any visitors. A user’s vulnerability to the malware attack launched by the site hack would depend on a number of factors, including the type of security used on a PC, the operating system, and possibly the browser version.
“This saga confirms our many previous warnings that obfuscated code posing a serious threat to Internet users’ PCs, said Finjan CTO, Yuval Ben-Itzhak, who has devoted a fair amount of time in recent months to finding these hacks.
“Our Threats Reports have continued to identify the increasing use of code obfuscation as a means of bypassing traditional signature-based solutions in order to propagate malware,” Ben-Itzak continued, taking a pop at the anti-virus products against which his company in part competes.
“It also highlights the fact that no web portal, no matter how high ranking, can be totally secure against a system hack and consequent infection of its visitors. Web users need to exercise caution at all times,” he said.
Finjan has it had informed CBS of the issue, but that the Russian exploit server had in any case been taken offline, neutering the attack for the time being.
iFrame and SQL injection attacks on big-name websites have been one of the fashionable attacks of 2008, embarrassing a string of household names.
If you are like me, you are probably going to spend some time over the next few days doing some Christmas shopping online. If so, I have stumbled onto something pretty cool inside the Twitter social network, just follow 
Just so no one else out there thinks that they have lost their mind, there was never a wordpress 2.6.4, instead there was a bogus version of wordpress floating around that wasn’t legit so the guys at AutoMattic in an effort to stay ahead of the folks issuing 2.6.4 have opted to skip that version and go directly to 2.6.5.
Matt, our server administrator at
I was surprised to learn tonight that Eclipse Aviation had filed for bankruptcy protection. I have been following this company since my partner Stephen, who is also a pilot, turned me onto it.
Several times my partners and I have played around with the idea of acquiring a smaller hosting company that was for sale on the open market. We have the infrastructure to accommodate several times over the number of clients we currently have and purchasing a smaller company seems like a logical choice for us to quickly grow our client base.
I am a little late to the punch on this one but MySpace has launched their own self-serve advertising platform. I am not a huge MySpace fan so this one almost slipped by me. I spent a little time tonight checking it out and I have to admit that their application for building the ads is pretty nice and very simple to operate.
A hot topic in the Facebook Developer Community right now has to do with the idea that Facebook will soon start charging a $375 application verification fee annually to developers who develop applications for the Facebook platform. In exchange, the developers applications will be awarded an official facebook stamp of approval badge and priority listing above other applications. I want to go on record as saying that I am personally in favor of this, I think that it will reduce the number of spammy applications that are out there as well as life the bar in terms of what goes live. 





