Feeds

LizaMoon mass-injection attack reaches epidemic proportions

iTune URLs and 380,000 other pages poisoned

Secure remote control for conventional and virtual desktops

Malware writers are using website vulnerabilities to inject malicious scripts into thousands of websites as part of an ambitious attack ultimately designed to redirect surfers to a site pimping rogue anti-virus packages.

The so-called LizaMoon mass-injection attack uses SQL injection trickery to inject a line of malicious code into compromised pages, as explained in an advisory by net security firm Websense here. According to a Google Search, over 380,000 URLs have been compromised, including several web locations associated with iTunes URLs, as part of the attack.

The count only looks at unique URLs, not infected hosts, a more meaningful metric. Even so the assault still counts as among the most widespread mass-injection attacks on record. The assault, first spotted on Tuesday, started off using the domain lizamoon.com, but since then other domains have been deployed in the attack.

The domains linked to the attack host basic JavaScript code that redirects surfers towards a well-known rogue anti-virus site. This trick only worked in cases where surfers first visited a compromised site. Downloading podcasts or music via iTunes was never a risk thanks to the architecture of Apple's service.

Patrick Runald, of Websense Security Labs, explained: "iTunes downloads RSS/XML feeds from the publisher to update the podcast and list of available episodes. We believe these RSS/XML feeds have been compromised with the injected code. The good thing is that iTunes encodes the script tags, which means that the script doesn't execute on the user's computer." ®

Beginner's guide to SSL certificates

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.