'Zombie' exploits cached by search engines
TechWorld.com - More than a year after first coming to light, the caches of major search engines are still providing a safe hiding place for malicious code, a security company has revealed.
The latest warning comes from security company Aladdin Knowledge Systems Ltd., which logged an attack against a university Web site that was eventually traced back to just such a "poisoned cache." The originating site had been taken offline, but the code from it was still able to spread by living on in the caches of a major search engine.
To make matters worse, cached malicious code could circumvent URL filtering systems because they would stop only the original site address and not the site as found via a search engine indexing it from cache.
Aladdin didn't specify the engine involved in the incident, but did say the problem affected Google Inc., MSN Live and Yahoo Inc.. According to Ofer Elzam, director of product management for Aladdin eSafe, cached pages could remain active for weeks and possibly even months, and they would remain in their original state until the cache algorithm refreshed its store.
"As I see it, they [search engines] have done nothing to solve it," he said of the problem. "It is they who are infecting the users. Do they feel responsible?"
This type of cache poisoning was first noticed around four years ago, and security company Finjan Inc. claimed last year that it was also to some extent affecting Internet service providers and enterprise caching systems.
"This is more than just a theoretical danger. It is possible that storage and caching servers could unintentionally become the largest 'legitimate' storage venue for malicious code," Finjan Chief Technology Officer Yuval Ben-Itzhak said at the time. "Almost every malicious Web site out there has a copy on a caching server."
The attack documented by Aladdin involved a nest of interlinked Web sites, and a swarm of over 100 Trojan horses, of which 51 were not detectable by signature-based scanning products. Advanced cross-site scripting attacks and code injection could also be launched from cached sites, the company said.
Reprinted with permission from
zombie
Additional Resources



White Papers & Webcasts
Extending Client Refresh - 11 Steps to Maximize Savings
Register Now!
Tackling the Top Five Network Access Control Challenges
Computerworld and Juniper invite you to download this white paper.
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
How to Secure and Accelerate Your Oracle Applications
Learn about the escalating application performance and security challenges facing corporations, today!
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Enterprise Application Delivery: No User Left Behind
Gain the ability to deliver applications to all users, using any device, across any network.
Consolidate Your Servers and Storage to Lower Costs with Oracle Database 11g
Register for this webcast!
Accelerate SSL Encrypted Applications
Gain complete visibility into SSL application sessions, making it easy to apply appropriate acceleration and security controls to all SSL traffic.
The Commercialization of ITIL: Lessons Learned
Register for this event today!
