Mass infection turns websites into exploit launch pads
More than 57K pwned
Malicious hackers have managed to infect about 57,000 web pages with a potent exploit cocktail that targets a variety of vulnerable applications to surreptitiously install malware on visitor machines.
The exploits install an assortment of nasty software, including Gologger, a keystroke logging trojan, and a backdoor that attempts to connect to a website hosted in China, according to Mary Landesman, a researcher at ScanSafe, a company that protects end users from malicious websites.
The vast majority of search results returned by Google and Yahoo failed to detect the threat despite the use of technology on both sites that's supposed to prevent users from clicking on malicious links.
Web infections are an increasingly common way for criminals to get their malware installed on end-user machines. Because the attacks occur while people are visiting sites they know and are often operated by reputable businesses and charities, few victims have any reason to suspect what's happening behind the scenes.
Landesman said in an email that she's been tracking a separate mass infection that in late June was used to deliver exploits targeting a zero-day ActiveX vulnerability. While the number of infected sites was once in the millions, it has since slipped to about 70,000.
SQL injection attacks exploit weaknesses in web applications that fail to adequately scrutinize text that users enter into search boxes and other web fields. The attacks have the effect of passing powerful commands to the website's back-end database.
Landesman's report is available here. ®