Feeds

Infection-by-cache risk unearthed

Caches give malware longer life

The Power of One eBook: Top reasons to choose HP BladeSystem

Malware housed on storage and caching servers, such as those used by ISPs, enterprises, and leading search engines, continues to pose a risk after websites containing malicious code have been pulled.

So says web security firm Finjan, which warns that instead of pointing users towards sites hosting malware, hackers could try to dupe users into visiting contaminated caches. The trick might be used to foil URL filtering products, it says.

"This is more than just a theoretical danger," Finjan chief technology officer Yuval Ben-Itzhak said. "It is possible that storage and caching servers could unintentionally become the largest 'legitimate' storage venue for malicious code. Such 'infection-by-proxy' introduces new risks for businesses and consumers where trusted web addresses become a potential distributor of malicious code - making URL Filtering solutions blind."

Finjan has published obfuscated examples of malware found on storage and caching servers to support its claims.

One well-known hacking tactic involved breaking into vulnerable web servers to install Trojan downloader code, which often takes advantage of browser vulnerabilities to download malware onto target PC (examples here and here). Finjan's point is that users visiting a cached copy of such (potentially mainstream) sites would be infected even if the main site pulled the malware. Search engines are not doing enough to flush their caches, it warns."

Finjan has sent search engines and service providers technical details of its discovery, uncovered by Finjan's Malicious Code Research Centre (MCRC) during its quarterly security trends analysis, and is continuing its dialogue with these firms in the hope of nipping the problem in the bud.

Finjan's net security report, which also discusses the increased use by hackers of Web 2.0 technologies to upload malware and the illicit trade in exploit code, can be found here (registration required). ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.