Riding the Net risks drive-by malware download attack

Peter Dinham
Tuesday, 07 July 2009 07:08

Business IT - Security

Drive-by download malware is still the most often downloaded nasty by Internet users, with vulnerabilities in Adobe and Microsoft products often the stalking horse of the trojans spreading infection around the Web.

According to Kaspersky in its latest report listing the top 10 e-threats, a Trojan downloader program, Gumblar.a, is the number one threat, described by Kaspersky as an excellent example of malware used in drive-by downloads.

Kaspersky says Gumblar.a is a small encrypted script which, when executed, redirects the user to a malicious website, where a series of vulnerabilities is then exploited to download a malicious executable file from the website and install it on the user’s computer.

Once installed, the file affects the user’s web traffic by modifying Google search results, and according to Kapersky, it also searches the computer for passwords to FTP servers in order to infect them.

The result, says Kaspersky, “is a botnet of infected servers created by cybercriminals which can be used to download any type of malicious program to users’ computers. The number of infected servers is enormous and, furthermore, the malware is still spreading to unprotected computers.”

Another notable example of drive-by download malware cited by Kaspersky is a Trojan-downloader program, LuckySploit.q, which is in third place in the second ranking and is also present in the first top 20.

Kaspersky says LuckySploit.q is a skillfully obfuscated script, which first harvests browser configuration data from the user’s computer. It then encrypts the data using an RSA public key and sends it to a malicious website.
CONTINUED page 2