We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Over 1m websites hit by malicious HTML hack

Major sites targeted by attackers

More than a million web pages, including many well-known sites, have been hit the growing web threat highlighted by security researcher Dancho Danchev earlier this month.

"The number and importance of the sites has increased," wrote Danchev in a blog posting where he reported that trusted US websites such as USAToday.com, Target.com and Walmart.com have been hit with the attack.

The criminals behind this have not actually hacked into servers; they are taking advantage of web programming errors to inject malicious code into search results pages created by the websites' internal search engines.

Here's how an attack would work: the attacker searches for popular keywords, such as 'Paris Hilton', on the website's internal search engine. But instead of conducting a normal search, the hacker tacks an HTML command to the end of his search. This command that opens up an invisible iFrame window in the victim's browser that then redirects it to a malicious website, which then tries to install fake antispyware or a version of the Zlob malware on the victim's PC.

In order to boost their Google rankings, websites often save a copy of these search results and submit them to Google. When a victim searches Google for the keyword, these cached search results then pop up, with the malicious code now inside them.

"Malicious parties are actively poisoning these sites search query caching feature to position the keywords among the top ten search results, thereby infecting anyone coming across them," said Danchev.

He believes that over 1 million web pages have been infected using this technique.

"The more keywords they submit with [malicious] script, the more pages with popular keywords the high page ranked sites would cache," he said. This increases the chance that someone will see the search results hosted on the reputable site and click on the malicious page.

The websites that have been hit with this attack could fix the problem by doing a better job of checking the search queries on their internal search engines to make sure that there is no malicious code in them, Danchev said.

Hackers are increasingly looking for ways to install their code on trusted websites. In recent weeks, security vendors have found hundreds of thousands of web pages affected by this and other similar attacks.

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model