|
|
|
New malware responsible for 42 per cent of all malicious infections on the web
A new attack known as Gumblar is continuing to blow all previous web-based malware out of the water, with a new infected web page found every 4.5 seconds, according to Sophos.
The security company said that Troj/JSRedir-R is now found six times more often than its nearest rival Mal/Iframe-F; and is responsible for almost half of all malicious infections found on websites over the past seven days.
Graham Cluley, senior technology consultant at Sophos, said: "No-one should be in any doubt that the web is still the main vector of attack for cybercriminals, and this new threat suggests this situation isn't going to change anytime soon.
"The problem is that too many computer users still think there's no danger in surfing the web, but with legitimate sites often falling victim to these attacks, it's time to wake up. Hackers won't stop targeting the web as it's proving a successful way for them to spread their infections. To combat this, it's essential to scan every website for malicious code before visiting it."
JSRedir-R, which has been found on high traffic legitimate websites, loads malicious content from third-party sites (including one called Gumblar.cn, inspiring some security vendors to dub the threat 'Gumblar') without users' knowledge. The malware can then be used to steal sensitive information for financial gain, to commit identity theft or to meddle with search-engine results.
Sophos advises users of other anti-malware solutions to check their products are updated and offering protection.
Related articles
Attached ZIP file in emails could con people into downloading banking Trojan
Sound too good to be true? We've found some programs that are so good we're amazed there is no price tag. We cast our eye over 30 of the best
Sony has confirmed that credit card details may have been stolen by hackers
Q.How do I store musician and other information about...
Q.Why can't my browser find the website address I typed...
Q.All updates have been downloaded, so why won't Windows...
What the web knows about you
20 of the best memes
How to make your computer run more quietly
Choose Gold, Silver or Bronze membership
Save up to 40% on the cover price of each issue
Get access to the subscriber club exclusive website
Our price won't be beaten by any shop or website
A smartphone that's eye-catchingly different.
|
|
|
|
|
Nikon Coolpix S570 BlackPrice: £66.99 |
Computeractive Ultimate Guide - Storage, Sharing & BackupPrice: £5.99 |
Back Issue CD-Rom 13 (2010)Price: £14.99 |
Hallmark Card Studio DeluxePrice: £15.31 |
Marine AquariumPrice: £15.41 |
Gumblar Rumblings Targeting Wrong People
An old friend has been back in the headlines this week - Gumblar aka Troj/JSRedir-R. Can't see why that name didn't catch on... Anyway, it's back, and it's getting smarter. Gumblar is a trojan/downloader. It doesn't do anything nasty on its own, it's just the tool for getting malware onto user's PCs. Until now, it is this end of the problem that has been frequently addressed. For businesses, however, the real threat is not compromised PCs. True, this is no fun at all, but almost everyone is running desktop antivirus, and I would hope most organisations have some sort of web filtering with malware protection. No, the biggest threat to businesses is becoming a malware host. For many businesses the web is their shop window. If their website becomes a malware host, it could cause massive damage to their online profile. Not only are they likely to be blacklisted by public-spirited search engines and other filtering systems, but their reputation may suffer as people work out where and how they were infected. Small and medium businesses are more likely to suffer these attacks than any other: those with sites with sufficient visibility, and insufficient security. Some reports suggest that compromised FTP (1985 called, it wants its protocol back) passwords were to blame for many of the infected sites. From experience though, I would suggest that these clever guys will have more than one way to crack that nut. Forum software and Content Management Systems are prime targets: easily spotted, and usually helpfully accompanied by a version number. If there are known exploits you are extremely vulnerable. My top tips for webmasters: 1. If you are using FTP, stop. Think. Ask your webhost if there's a more secure alternative, SFTP for example. 2. If you are using "off the peg" CMS or forum software, keep it up-to-date, and be aware of new vulnerabilities. 3. Keep on top of your passwords - don't save them, unless you encrypt them, and make sure you are aware of all of them, many site components have default passwords
Posted by Tom Newton, SmoothWall, 20 May 2009