Nine Ball attack strikes 40,000 Web sites

More than 40,000 Web sites have been hit by a mass-compromise attack dubbed Nine Ball that injects malware into pages and redirects victims to a site that will then try to download Trojans and keylogger code, Websense said today.

Top urban legends in IT security

According to Websense, which has tracked Nine Ball for a week and a half, the compromised Web site, loaded with malware, will first try to identify a Web visitor by IP address to discover if it’s a repeat visitor. To evade security researchers and investigators who would likely be among any repeat visitors, the Web page will dump a repeat visitor onto the search engine site Ask.com.

“Ask.com is nothing malicious, you’re just sent there if they’ve seen you before,” says Stephan Chenette, manager of security research at Websense. This type of inspection and re-direction is becoming commonplace in Web attacks as a way to evade investigation, he points out.

If a Web visitor is new, the victim is pushed through a few more re-directions to land at the site www.nine2rack.in, which may sound like a site in India, but is in Ukraine, Websense believes. The URL inspired Websense to name the attack method Nine Ball.

The final stop for a Web victim includes a drive-by download attempt after the malware checks for vulnerabilities in the browser, Adobe or Quicktime software on the user’s desktop. If it succeeds, the attack will download a Trojan with a keylogger component that many anti-virus software packages do not yet identify, according to Websense.

“These Trojans have a very low detection rate,” Chenette says. “Many are polymorphic or created on the fly.”

There are a number of security failures that can help Nine Ball to compromise so many Web sites, including SQL-injection attacks on susceptible Web sites as well as bots that have stolen user passwords and logins for administrators of Web sites.

The Nine Ball exploit is distinct from two other mass-compromise methods observed of late -- Beladen and Gumblar -- but it’s possible the same instigators are behind them, Chenette says.