- 4chan hell raisers finding fame brings heat?
- The 10 dumbest mistakes network managers make
- NetApp quits bidding war in face of EMC opposition
- CompuServe closes after 30 years
- Google to launch open-source Chrome OS this year
The massive attacks against hundreds of thousands of Web pages that started earlier this month has spread to some of the Internet's most prominent sites, including those for USA Today, ABC News, Target and Wal-Mart, researchers said Friday.
Dancho Danchev, the Bulgarian security researcher who first reported the attacks two weeks ago, said that the attacks had spread to a long list of high-profile sites, which have had their search results poisoned with malicious IFRAME code. "The attack's been ongoing for almost a month now," Danchev said in an e-mail.
According to both a follow-up post by Danchev to his own blog, and analysis conducted by researchers at Symantec Corp., hackers have inserted IFRAME code into the saved search results of an unknown number of legitimate sites. People who visit those sites and use the compromised search tool are redirected by the IFRAME code to rogue security software and bogus codec sites, which in turn download malware to the victimized Windows PCs.
The attack code that eventually ends up on users' machines includes newer variants of the Zlob Trojan horse, as well as other backdoors and downloaders.
Danchev identified four IP addresses that he claimed host the malicious files; Symantec backed up his findings. "We have confirmed the attack here at Symantec," said Joji Hamada, a Symantec researcher, in a short post to the company's security blog.
The IP addresses Danchev fingered include:
72.232.39.252
195.225.178.21
89.149.243.201
89.149.220.85
The four addresses are associated with servers located in the U.S., Panama and Germany, Danchev said.
"The main IPs behind the IFRAMES are still active, new pieces of malware and rogue software [are] introduced, hosting for which is still courtesy of the Russian Business Network, and we're definitely going to see many other sites with high page-ranks targeted by a single massive SEO [search engine optimization] poisoning in a combination with IFRAME injections," said Danchev in his blog post.
When Danchev raised the alarm earlier this month, the compromised sites included a mix of both legitimate and questionable URLs, including those for the North Carolina State University library and the U.S. government's Medicare program, as well as BitTorrent sites serving up pirated software.
Comments (1)
Please Define TERMSBy Anonymous on March 31, 2008, 7:28 pmYou provide links for the obvious, like Wal-Mart and ABC News, but not what people are most likely to have a question about - IFRAME. What is it? Who developed...
Reply | Read entire comment
View all comments