Thousands of sites loaded with potent malware cocktail

Noscripts

Will noscripts on firefox provide protection?

Or is it time to go back to lynx?

Not the cybercriminals to blame is it!!!

"The trick makes it extremely difficult for webmasters and anti-malware programs to detect the threats."

In which case then the options are very limited, we can only

a) blame Microsoft for not fixing cryptapi AFTER MORE than 9 (well 10, NOW) weeks.

b) blame someone else.

How about webmasters actually securing their sites. I guess this solution is TOO obvious and simple, so I guess we're back to solution a) or b) again.

What to do?

So is it time to start browsing the web in a dedicated virtual machine that I reset to a known safe snapshot after each use? Either that or switch to Linux or Mac as my desktop OS (not because they're significantly more secure, just that the lower install base results in fewer attacks).

But what do I tell my less computer literate friends and family? Stop using the web? These new attacks that exploit multiple weaknesses and only require a visit to a web page to trigger are getting ridiculous.

Not to be picky or anything,

But there's no link to source, and no further info about signs of infection anyone might use to stop backdoor comm.

server side script

The script is server-side; it's PHP which means it'll happily reside on *nix servers... and in all probability it's (cheap) *nix hosts that have been targeted. That does not mean it will affect *nix clients however - it simply uses PHP to glean some information about the user's system, looking for known vulnerabilities - as the story states - initially in Adobe software and then MS vulns.

Unless you're doing something seriously daft, you should be safe under *nix (depending on payload). Under windows, noscript _may_ prevent the attack if it happens to be blocking Flash at the time of viewing a compromised site. If. however, it's a site that you've already white-listed, all bets are off... and that's assuming you've got Windows itself patched up to date.

My money is on an FTP breach - there have been a few in recent months, primarily targeting the cheap *nix hosting market - it seems to be something in the way the hosting companies have their systems set-up (open or anonymous FTP access - no IP address restrictions) - using keyloggers was the first "explanation" uttered (e.g. it's not our fault, it's yours for not securing your PC) but it could be packet sniffing or brute force... whatever.

This recent spate of cracks have normally resulted in .htaccess uploads (full of Mod Rewrite redirects) - it was only a matter of time before someone combined something genuinely dangerous with these breaches.