Malicious Ads Infect 65 Websites, Drop ZeroAccess Trojan

TheKid7 · Jun 20, 2013

Malicious Ads Infect 65 Websites, Drop ZeroAccess Trojan:

As many as 65 websites have been compromised in an attack that has snared another Washington, D.C.-area media website as well as a number of travel and leisure sites.

While the sites aren’t topically related, they’re all hosting advertisements injected with malicious code hosted on googlecodehosting[.]com, googlecodehosting[.]org and googlecodehosting[.]net, all of which resolve to the same IP address, security company Zscaler said. The IP is currently offline.

The ads were delivered by openxadvertising[.]com, which Google SafeBrowsing is blocking, Zscaler said. The attacks are exploiting two Java vulnerabilities CVE-2013-1493 and CVE-2013-2423, both of which are being used to drop the ZeroAccess Trojan on affected machines, Zscaler said.

ZeroAccess is financial malware that deals in click-fraud, Bitcoin theft and includes rootkit capabilities that help it avoid detection from security software. It’s spread primarily through a number of botnets, including peer-to-peer botnets...........
Click to expand...

http://threatpost.com/malicious-ads-infect-65-websites-drop-zeroaccess-trojan/

Dermot7 · Jun 20, 2013

See: https://www.wilderssecurity.com/showthread.php?t=349014

EASTER · Jun 20, 2013

That's all so ridiculous. Every single time we read something happens like this then how does it get thru?

Java = The real terror in these type entryways time and time again.

Just uninstall the stupid thing and that bridge is collapsed.

Log in or Sign up

Malicious Ads Infect 65 Websites, Drop ZeroAccess Trojan

TheKid7 Registered Member

Dermot7 Registered Member

EASTER Registered Member

Log in or Sign up

Malicious Ads Infect 65 Websites, Drop ZeroAccess Trojan

TheKid7 Registered Member

Dermot7 Registered Member

EASTER Registered Member

Useful Searches