Feeds

Attack flogged through shiny-clicky social media buttons

66,000 users popped by malicious Flash fudging add-on

Internet Security Threat Report 2014

Web admins beware: social media buttons that load scripts from unknown external sites could see your sites foisting the FlashPack exploit kit to visitors.

Several sources warn that popular JavaScript social media panels are being modified to load external resources that pulled down FlashPack, formerly known as SafePack, which has so far compromised at least 66,000 users.

It was loaded onto visitor computers who failed to apply a February Adobe Flash patch (CVE-2014-0497), which would capture a decent number of victims who still ignore software updates.

The EK Wild West: Kahu Security

The EK Wild West: Kahu Security

This FlashPack delivered the Carberp trojan that opened a backdoor in victim machines to steal data.

Some 87 percent of victims were from Japan, while the others heralded from the United States, Taiwan and India.

"... a JavaScript file on the home page of the add-on is loaded. This alone should raise red flags: it means that the site owner is loading scripts from an external server not under their control," Trend Micro fraud researcher Joseph Chen said.

"It's one thing if it loads scripts on trusted sites like Google, Facebook, or other well-known names; it's another thing to load scripts on little-known servers with no name to protect."

Chen advised web admins to be "very cautious" when incorporating add-ons to websites which relied on externally hosted scripts because it was "trivial" to use these to compromise visitors.

Bad add-ons could also slow down site performance.

A better choice was to use add-ons that kept everything within the same server and for users to maintain up to date with software security patches.

It was unknown but likely that the trojan payload would be detected by most antivirus vendors. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.