PC-pwning infection hits 30,000 legit websites And counting

Malcontent · May 30, 2009

http://www.theregister.co.uk/2009/05/30/mass_web_infection/

A nasty infection that attempts to install a potent malware cocktail on the machines of end users has spread to about 30,000 websites run by businesses, government agencies and other organizations, researchers warned Friday.

The infection sneaks malicious javascript onto the front page of websites, most likely by exploiting a common application that leads to a SQL injection, said Stephan Chenette, manager for security research at security firm Websense. The injected code is designed to look like a Google Analytics script, and it uses obfuscated javascript, so it is hard to spot.
Click to expand...

The malicious payload silently redirects visitors of infected sites to servers that analyze the end-user PC. Based on the results, it attempts to exploit one or more of about 10 different unpatched vulnerabilities on the visitor's machine. If none exist, the webserver delivers a popup window that claims the PC is infected in an attempt to trick the person into installing rogue anti-virus software.

The rogue anti-virus software uses polymorphic techniques to constantly alter its digital signature, allowing it to evade detection by the vast majority of legitimate anti-virus programs. Because it uses obfuscation, the javascript is also hard to detect by antivirus programs and impossible to spot using Google searches that scour the web for a common string or variable.

"For the common user, it's going to be possible but difficult to determine what the code is doing or if it's indeed malicious," Chenette told The Register. "We can see this quickly growing."
Click to expand...

Rmus · May 30, 2009

The malicious payload silently redirects visitors of infected sites to servers that analyze the end-user PC.

Because it uses obfuscation, the javascript is also hard to detect by antivirus programs and impossible to spot using Google searches that scour the web for a common string or variable.
Click to expand...

Note that if you have scripting in the browser configured per site then the javascript code on the site to which you are redirected will not execute.

I have javascript enabled for Wilders:

If I click on the link to the article -- taking me to another site-- javascript will be disabled:

----
rich

Searching_ _ _ · May 30, 2009

I'm feeling frisky...hehehe.

Oh...Yeah! bown..bown.

Not too long now.

Just a few clicks away.

MMMMHHMMM!

Oh no! The people at those security forums told me not to go to dodgy websites.

I guess they were right all along.

I guess I should click "Remove Threats" so I can clean this PC.

There's gotta be just one site that's not infected. Maybe this one...

What is going on? This thing is acting funny.

I can't go to Wilders for cleaning. Last time I tried to post a log they got a little touchy. Told me to go somewhere else.

All of the other sites won't help me for 2 weeks...

I know, I'll disguise my plea for help by pretending I'm a knowledgable techie.
Impress someone into helping me.

Log in or Sign up

PC-pwning infection hits 30,000 legit websites And counting

Malcontent Registered Member

Rmus Exploit Analyst

Searching_ _ _ Registered Member

Log in or Sign up

PC-pwning infection hits 30,000 legit websites And counting

Malcontent Registered Member

Rmus Exploit Analyst

Searching_ _ _ Registered Member

Useful Searches