Slashdot Mirror
10,000-website Strong Malware Maze Created by Criminals
Stony Stevenson passed us an ITnews article about the newest scam in online crime. Some 10,000 web pages have been rigged by IT-minded criminals, with the aim of hijacking unsuspecting PCs. The site reports that the users are redirected through a maze of malware, all with the goal of gaining access to personal user information. "The reprogrammed web pages are probably victims of an automated attack that included scanning the internet for unsecured servers and planting a piece of JavaScript code that redirects to a site in China to serve up the malware. The malware cocktail attempts to exploit vulnerabilities in Windows, RealPlayer and other applications to break into the PC. A back door also allows the subsequent installation of additional malicious programs. McAfee Avert Labs first spotted the attack on 12 March. 'Of the 10,000 pages that were compromised a number have already been cleaned up,' the firm stated."
Most of the sites that most of the average public uses are heavy on Javascript. A web browser shipped without support for JS by default is not going to win many users.
...how do we check our sites to ensure that this code has not been planted. The article gives no clue at all. It doesn't even identify if is platform or technology specific, etc. Just that someone else has set up a huge botnet.
Even sysadmins and webmasters that use best practices and diligently patch, etc. can be gotten because there are always undisclosed holes that are utilized. In fact, were I in that game and I figured out something to defeat security, it would keep it under my ragged black hat and never share that info.
"Often you hear warnings about not going to untrusted sites," said Craig Schmugar, threat researcher at McAfee Avert Labs... That is good advice, but it is not enough. Even sites you know and trust can become compromised."
In the old days it was easy to avoid malicious sites. Now even your neighbor could be the terrorist... err..I mean.. even sites you know and trust can become compromised.
At least this threat researcher offered a calm analysis with plenty of advice about how to avoid such attacks without recoiling from the web in fear.
MUST BUY MCAFEE...
Why not just disallow redirection and loading of off-domain/off-host data from scripts?
Disabling scripts entirely disables dangerous behavior, sure... But is also disables lots of desirable functionality that most people want.