Viral web infection siphons ad dollars from Google A compromise that is moving virally across websites is making unwitting people who surf to them part of a botnet that redirects Google search results, a security researcher has warned. During the past week, the number of websites identified as infected have almost tripled, according to researcher Mary Landesman with real-time …
The obfuscated JavaScript on compromised sites (which Sophos intercepts as Troj/JSRedir-R) accounts for about 42% of all of the infected webpages we've seen in the last week.
That's a mightily impressive six times more infections than the tried and trusted malicious Iframe attack of Mal/Iframe-F.
We've published some further information and stats on our site at http://www.sophos.com/blogs/gc/g/2009/05/14/malicious-jsredir-javascript
I'd recommend that surfers check their protection is up-to-date and fighting this one.
I work for a fairly large hosting provider and we're seeing it here too.
Interestingly, we're also seeing a .htaccess being dropped into the root ftp folder which attempts to perform various redirects, set (compromised) custom error docs and calls some perl scripts.
Ammusingly they don't upload the error docs, scripts and their .htaccess is malformed, which simply took the sites offline instead. If the error docs had been correctly uploaded then they'd have spread via the 500 internal server errordoc though.
The reason I mention it is because it's from the same 'straight-in' access from compromised FTP accounts. I cleared out about 15 infections yesterday - of which all logged in first time with the right details.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
