A blossoming Web attack, first reported by security researcher Dancho Danchev earlier this month, has expanded to hit over a million Web pages, including many well-known sites.
"The number and importance of the sites has increased," wrote Danchev in a Friday blog posting where he reported that trusted Web sites such as USAToday.com, Target.com and Walmart.com have been hit with the attack.
The criminals behind this have not actually hacked into servers, but they are taking advantage of Web programming errors to inject malicious code into search results pages created by the Web sites' internal search engines.
Here's how an attack would work: the attacker searches for popular keywords, such as "Paris Hilton," on the Web site's internal search engine. But instead of conducting a normal search, the bad guy tacks an HTML (Hypertext Markup Language) command to the end of his search. This command that opens up an invisible iFrame window in the victim's browser that then redirects it to a malicious Web site, which then tries to install fake antispyware or a version of the Zlob Trojan Horse malware on the victim's PC.
In order to boost their Google rankings, Web sites often save a copy of these search results and submit them to Google. When a victim searches Google for the keyword, these cached search results then pop up, with the malicious code now inside them.
"Malicious parties are actively poisoning these sites search query caching feature to position the keywords among the top ten search results, thereby infecting anyone coming across them," said Danchev, in an instant-message interview.
He believes that over 1 million Web pages have been infected using this technique.
"The more keywords they submit with [malicious] script, the more pages with popular keywords the high page ranked sites would cache," he said. This increases the chance that someone will see the search results hosted on the reputable site and click on the malicious page.
The Web sites that have been hit with this attack could fix the problem by doing a better job of checking the search queries on their internal search engines to make sure that there is no malicious code in them, Danchev said.
Hackers are increasingly looking for ways to install their code on trusted Web sites. In recent weeks, security vendors have found hundreds of thousands of Web pages affected by this and other similar attacks.
- Sponsored Resource:Are you ready for virtualization? Try the sever assessment tool.
- Sponsored Resource:Stay at home servers. Learn more about a home server for your family.
- Sponsored Resource:Get the communications, data, and security a business needs in one neat package. Learn more.
- Sponsored Resource:Learn more about ultra light notebooks from Asus and the best warranty in the industry.
- Sponsored Resource:Thinking about a new Laptop? Lenovo has models to meet everyone's needs.
- Sponsored Resource:Get the truth about remanufactured ink. Learn more from HP.
- Sponsored Resource:Six smart ways to grow small business IT
News For Your Business
- Study Paints Open-Source Software as a Security Risk
- Laptop Security: Keep the Bad Guys at Bay
- SecuriKey Professional Edition 2.1
- San Francisco's Mayor Gets Back Keys to the Network
- Top Spammer Sentenced to Nearly Four Years
Community Comments