News19,135 Articles

May 19, 2009

Google results poisoned with malicious links

Security threat found on legitimate websites

Robert McMillan

A new attack that peppers Google search results with malicious links is spreading quickly, the US Computer Emergence Response Team has warned.

The attack, which has intensified in recent days, can be found on several thousand legitimate websites, according to security experts. It targets known flaws in Adobe's software and uses them to install a malicious program on victims' machines, CERT said.

The program then steals FTP login credentials from victims and uses that information to spread further. It also hijacks the victim's browser, replacing Google search results with links chosen by the attackers.

Security experts started tracking the attack in March, when it had infected several hundred websites, but in recent weeks the number of infected sites has jumped dramatically. The attack has been called Gumblar because at one point it used the Gumblar.cn domain, though on Monday it had switched to a different one.

Security vendor ScanSafe has counted more than 3,000 infected websites, up from around 800 just over a week ago.

That kind of continued growth is unusual, according to Mary Landesman, a senior security researcher with ScanSafe. Attackers have launched many widespread web attacks over the past few years, but after a few months the total number of infected sites usually drops as webmasters clean up their servers.

With Gumblar, more and more sites are now being infected. Landesman believes it's because Gumblar's creators have been good at obfuscating their attack code and making it harder to spot on infected sites. And because they've been stealing FTP login credentials, they've been able to use a few new tricks to get their software onto the sites. "They're doing things like changing folder permissions … and leaving behind multiple ways that they can get back into the server," she said.

Still, web attacks have become so widespread that Gumblar remains a relatively small-scale phenomenon, according to Symantec Security Response Product Manager John Harrison. Last year, Symantec counted 18 million online attacks against its customers. With Gumblar, it has counted 10,000. "It's really just another day with drive-by downloads," he said. "There really are so many of these."

Security experts say that if you're using a fully-patched system with up-to-date security software, you should be protected from these attacks. To date, they've worked by hitting the victim with malicious PDF or Flash files.

See also:

PC security advice

Free whitepaper: Phishing for victims - Truth, myth and cybercrime

<<newer story | back to index | older story>>

Comments received


rosaleen pooler said on Thursday, 21 May 2009

i have just had a corupt trojan on my compter from a virus called personal virus, i have sky broadband but have mcafee security on my computer and ahve been told i have to pay to get rid and am not pleased about that is their anyway of removing it.

Peter H said on Sunday, 31 May 2009

Rosaleen - who's asking for money to remove a virus?
Surely not McAfee, their VRT is free.

Suzart said on Monday, 01 June 2009

I have the same thing and McAfee want £49.00 to clean it up - Strange the virus got on my system as McAfee was in stalled by dell

Help Please

Dragon said on Monday, 01 June 2009

MacAfee was the 1st antivirus I used. I was never that impressed with it as it could not deal with Trojans. I had to seek out where it was hiding and remove it manually. I then bought Norton. What a nasty bit of bloatware that was. New to PC's I had never heard of Freeware. Thanks to Scott at the Freeware Arena, I tried all sorts of applications for all sorts of problems.
Now I use Avast Free, which updates automatically every 6 hours, and have no problems. I give the PC a sweep with A Squared once a week [again the Free version] . That has to be manually updated but removes worms, trojans and other malware with no problem. Even my FW is Freeware. Why pay when the Freeware is so good?

What is this?

Subscribe to PC Advisor now and claim your FREE gift

Keep up to date by adding PC Advisor News to your iGoogle home page or Google Reader


Question of the day!

Does your smartphone replace your need for a laptop when on the move?

Question of the day!

Does your smartphone replace your need for a laptop when on the move?

% of PC Advisor readers agree with you

Yes
TBC
No
TBC

What tasks can your smartphone do that would have traditionally been done on a laptop?

119 characters remaining

Follow the conversation at @SmartphoneFocus

web browsing, search facilities, voip, email, word processing everything RT @Graham_D_C

Mainly email but getting better at spreadsheets etc, RT @IDGdan
Google


Recent reviews

Reviews index


Latest reader comments

Latest reader comments


Top news

News index


Latest blog entries

Blogs index


 Our RSS feeds

Sponsored Content

  • Take the internet to new places with the Nokia N800
    Communicate how you want to, where you want to with instant messaging, email and internet calling. View movies, browse the internet wirelessly and watch TV on the high-resolution screen and listen through high-quality stereo speakers with headphone jack.
    Buy now