Researcher: Beware of massive IFrame attack
Posted by: Bill Brenner
Network Security, Application Security, Information Security Threats, Security Management, Platform Security
Security researcher Dancho Danchev has raised the red flag in his blog about a new scam the bad guys are using to corrupt hundreds of thousands of websites with IFrame redirects. Visit one of these corrupt pages and you just might find yourself caught on another site rigged with malicious code.
The infamous hacking group known as the Russian Business Network (RBN) appears to have a hand in this, he says.
“The ongoing monitoring of this campaign reveals that the group is continuing to expand the campaign, introducing over a hundred new bogus .info domains acting as traffic redirection points to the campaigns hardcoded within the secondary redirection point, in this case radt.info where a new malware variant of Zlob is attempting to install though an ActiveX object.”
Danchev says these are the high-profile sites targeted by the same group within the past 48 hours, with the number of locally cached and IFrame injected pages within their search engines :
NCSU Libraries - lib.ncsu.edu - 372,000 pages bushtorrent.com - 147 pages
ChildCareExchange - ccie.com - 131 pages
The University of Vermont - uvm.edu - 120 pages
Hippodrome State Theatre - Gainesville, FL - thehipp.org - 112 pages
Minnesota State University Mankato - mnsu.edu - 94 pages
The California Majority Report - camajorityreport.com - 16 pages Trackback URL
Comment
RSS Feed
Email a friend
You must be logged-in to post a comment. Log-in/Register