'Zombie' exploits cached by search engines

TechWorld.com - More than a year after first coming to light, the caches of major search engines are still providing a safe hiding place for malicious code, a security company has revealed.

The latest warning comes from security company Aladdin Knowledge Systems Ltd., which logged an attack against a university Web site that was eventually traced back to just such a "poisoned cache." The originating site had been taken offline, but the code from it was still able to spread by living on in the caches of a major search engine.

To make matters worse, cached malicious code could circumvent URL filtering systems because they would stop only the original site address and not the site as found via a search engine indexing it from cache.

Aladdin didn't specify the engine involved in the incident, but did say the problem affected Google Inc., MSN Live and Yahoo Inc.. According to Ofer Elzam, director of product management for Aladdin eSafe, cached pages could remain active for weeks and possibly even months, and they would remain in their original state until the cache algorithm refreshed its store.

"As I see it, they [search engines] have done nothing to solve it," he said of the problem. "It is they who are infecting the users. Do they feel responsible?"

This type of cache poisoning was first noticed around four years ago, and security company Finjan Inc. claimed last year that it was also to some extent affecting Internet service providers and enterprise caching systems.

"This is more than just a theoretical danger. It is possible that storage and caching servers could unintentionally become the largest 'legitimate' storage venue for malicious code," Finjan Chief Technology Officer Yuval Ben-Itzhak said at the time. "Almost every malicious Web site out there has a copy on a caching server."

The attack documented by Aladdin involved a nest of interlinked Web sites, and a swarm of over 100 Trojan horses, of which 51 were not detectable by signature-based scanning products. Advanced cross-site scripting attacks and code injection could also be launched from cached sites, the company said.