Lahore High Court's Website Found to be Malicious

Lahore High Court’s Website Found to be Malicious

By Ahsan Javed · Sunday, Mar 7, 2010 0 Comments

Website security has always been an issue, here in Pakistan, as we seen a lot of incidences, where the official website of Cyber Response Center got hacked, Warid Telecom’s website found linking to some malware website. This time Lahore High Court’s website is found to be linking with highly restricted sites, which are reported to be infected with malicious scripts, by Google.

As you google “Lahore High Court” you get warning from the search giant that “This site may harm your computer”. And Google’s browser Chrome won’t even allow you open that site.

Above image is a downscaled version of original image which can be viewed here.

Going through the source code of Lahore High Court’s Website i.e. www.lhc.gov.pk, complete story gets revealed.

LHC website is found to be linking with some highly malware effected websites, and the chain goes on.

Above image is a downscaled version of original image which can be viewed here.

Following are the sites:

gtstyle.insaweb.co.kr
blog.seelenland.at

and finally you land on LHC’s website.

But the story does not end here. www.naxis.com seems to be kind of consultancy and advertising website, because as you go through their services, there is nothing like web development but on LHC’s website, some of the pages are even hosted on nAxis’s website.

Above image is a downscaled version of original image which can be viewed here.

Following the link “Cause List” at LHC’s website takes you to http://www.naxis.com/LHC/causelist/index.htm which in turn is a malware effected website.

Which links to:

moadonet.com
killerpilze.bplaced.net

Using Google’s Safe Browsing Tool, we can easily check the status of these websites. Following is the result what Google says:

Safe Browsing

Diagnostic page for lhc.gov.pk

What is the current listing status for lhc.gov.pk?

Site is listed as suspicious – visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 8 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 3 pages we tested on the site over the past 90 days, 2 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-03-05, and the last time suspicious content was found on this site was on 2010-03-04.

Malicious software includes 4 exploit(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

Malicious software is hosted on 7 domain(s), including insaweb.co.kr/, atlastaxi.qc.ca/, dreamznevents.com/.

2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including iways.net/, naxis.com/.

This site was hosted on 1 network(s) including AS2914 (NTT).