Feeds

Ad hijacking Trojan targets Google

Misdirection ruse

Security for virtualized datacentres

Security researchers have identified a Trojan that hijacks Google text advertisements, replacing them with "ads" from a different provider that are likely to be laced with spyware.

The Qhost-WU modifies an infected computer's hosts file, thereby poisoning systems with bogus DNS lookup records. The hosts file matches domain names of websites with corresponding IP addresses. By corrupting the file hackers can redirect surfers to domains controlled by hackers even when users visit a trusted location.

In this case, the modified file contains a line redirecting the host "page2.googlesyndication.com" from a server run by Google to an imposter, potentially depriving web masters of revenue while leaving infected punters in a pickle.

"This is a serious situation that damages users and webmasters alike," said Attila-Mihaly Balazs, a virus analyst at Romanian security firm BitDefender. "Users are affected because the advertisements or the linked sites may contain malicious code, which is a very likely situation, given that they are promoted using malware in the first place. Webmasters are affected because the Trojan takes away viewers and thus a possible money source from their websites."

Although damaging, the Qhost-WU Trojan hasn't spread particularly widely. BitDefender rates it as a medium risk pathogen.

Without commenting on Qhost-WU specifically, Google said it purges entries for sites containing malware from its search index. "We have cancelled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles," the ad trafficking giant told Reuters. ®

Beginner's guide to SSL certificates

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.