Hackers expand massive IFrame attack to prime sites
USA Today, Target, Wal-Mart and others have been affected
Computerworld - The massive attacks against hundreds of thousands of Web pages that started earlier this month has spread to some of the Internet's most prominent sites, including those for USA Today, ABC News, Target and Wal-Mart, researchers said today.
Dancho Danchev, the Bulgarian security researcher who first reported the attacks two weeks ago, said that the attacks had spread to a long list of high-profile sites, which have had their search results poisoned with malicious IFrame code. "The attack's been ongoing for almost a month now," Danchev said in an e-mail.
According to both a follow-up post by Danchev to his own blog and analysis conducted by researchers at Symantec Corp., hackers have inserted IFrame code into the saved search results of an unknown number of legitimate sites. People who visit those sites and use the compromised search tool are redirected by the IFrame code to rogue security software and bogus codec sites, which in turn download malware to the victimized Windows PCs.
The attack code that eventually ends up on users' machines includes newer variants of the Zlob Trojan horse, as well as other backdoors and downloaders.
Danchev identified four IP addresses that he claimed host the malicious files; Symantec backed up his findings. "We have confirmed the attack here at Symantec," said Joji Hamada, a Symantec researcher, in a short post to the company's security blog.
The IP addresses Danchev fingered include:
The four addresses are associated with servers located in the U.S., Panama and Germany, Danchev said.
"The main IPs behind the IFRAMES are still active, new pieces of malware and rogue software [are] introduced, hosting for which is still courtesy of the Russian Business Network, and we're definitely going to see many other sites with high page-ranks targeted by a single massive SEO [search engine optimization] poisoning in a combination with IFRAME injections," said Danchev in his blog post.
When Danchev raised the alarm earlier this month, the compromised sites included a mix of both legitimate and questionable URLs, including those for the North Carolina State University library and the U.S. government's Medicare program, as well as BitTorrent sites serving up pirated software.
"In the past, we've seen many low-profile sites being targeted with the IFrame attack," Hamada added, "but this time the list of hacked sites include many high-profile sites as well. This is very disturbing, because many big corporations often go out of their way to protect themselves, yet [they] get hit like this."
Danchev identified a long list of affected sites, including USAToday.com, ABCNews.com, News.com, Target.com, Walmart.com, Bloomingdales.com, WebShots.com, Sears.com, Forbes.com, Circuitcity.com, Epinions.com, JCPenney.com and those for the University of Vermont and Boise State University.
Symantec recommended that network administrators block both incoming and outgoing traffic to the four IP addresses, and Hamada urged IT staffs to take another sweep through their servers. "It might be a good time for everyone to audit their servers again," he said.
Users can protect themselves by rejecting any request to download an unexpected codec or security program.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts