The Latest in IT Security

The Daily Jang – The Online Pakistani Newspaper Compromised



Websense Security Labs™ ThreatSeeker® network has determined that the popular online Pakistani newspaper Web site the 'Daily Jang' (at has been compromised. Websense customers are protected from this attack by ACE, our Advanced Classification Engine

The Web site has been injected with malicious code in several locations. The code redirects visitor browsers to exploit Web sites. At the time this writing, the exploit sites that the Daily Jang redirects to are active and serve malicious code.

The paper is one of the most popular and oldest newspapers in Pakistan. The Web site gets a lot of daily traffic from its many loyal readers, both within and outside Pakistan. It also links to many other Web sites (Alexa report). Some reports indicate an average of more than 40,000 unique visits to the Web site a month. 


An infection can occur while visiting the main page of the site. The visiting user's browser is redirected silently, in the background, to an exploit site loaded with an exploit kit called 'g01pack' (we blogged not long ago about mass injections leading to this exploit kit). If one of the kit's many exploit attempts is successful, a Trojan Backdoor file is dropped onto the user's machine. The backdoor file currently holds a detection rate of 26%.


One of our internally developed power tools that we use in the labs to research and analyze Web sites is Fireshark™. Fireshark allows researchers to visually see and map all the Web sites that the browser connects to when visiting a Web address. (The Fireshark project is open source and also comes as a Firefox plugin. You can check it out at its official Web site:


Fireshark can map exactly what happens to the browser when surfing to a Web address. When is loaded to Fireshark, at the end of the process Fireshark creates a visual map of all of the connections made by the browser during the site visit. In the image below, the malicious Web site that the browser connects to when visiting is marked with the color red and the string TLD ( is also marked in red because it is compromised).


This is what the main page of looks like:



This is how Fireshark sees (depicts all of the connections made by the browser when browsing to; click to enlarge).


Injection Information


The site is injected in several places. The injection appears as an Iframe at the bottom of each injected page. A snapshot is provided below. You might think it ends here, but any security holes that leave the door open for attackers to inject malicious code may also be revealed by other attackers as well, this is the main reason why the Web site has another kind of malicious injection on many of its pages. In total there are two kinds of injections on The first appears as an Iframe (the first snapshot below), the second appears as obfuscated Javascript code that also silently redirects any browsing user to exploit sites; however, those exploit sites appear to be down at the time of writing of this post.


The ThreatSeeker network monitors constantly for security risks and as soon as it's cleaned we'll also update this blog post.


The injected Iframe on the main page of



The second injection appears as obfuscated Javascript code that eventually gets translated by the browser to an Iframe:




Special thanks to Websense researchers Tamas Rudnai and Artem Gololobov who contributed information to this post.

Leave a reply



Mission-Critical Broadband – Why Governments Should Partner with Commercial Operators:
Many governments embrace mobile network operator (MNO) networks as ...

ARA at Scale: How to Choose a Solution That Grows With Your Needs:
Application release automation (ARA) tools enable best practices in...

The Multi-Model Database:
Part of the “new normal” where data and cloud applications are ...



Latest Comments