Australian site under IFRAME attack, along with Wired and History.com

Alex Zaharov-Reutt
Tuesday, 11 March 2008 09:02

Your IT - Home IT

The University of Melbourne is suffering an IFRAME attack, along with a military site, other .edu sites, a couple of torrent sites and two big sites: Wired.com and History.com, with the Russian Business Network showing no signs of going out of business.

Major sites are being framed by IFRAME attacks after the revelations by security expert Dancho Danchev that ZDNet and CNET sites in Asia and the US were under attack and then quickly secured once the attacks came to light.

In our previous story “CNET stops IFRAME site attacks - who's next?”, we asked which major sites would next be targeted by the hackers, and we are unsurprised to discover that Danchev has already discovered the next website victims, which we’ll go into more detail shortly.

For those that are wondering what all the fuss is about, what IFRAMES are, and why they can be targeted, here is a quick reprisal from our CNET IFRAME story:

An IFRAME is an HTML 'Inline Frame', with a frame being described by the W3C this way:

"HTML frames allow authors to present documents in multiple views, which may be independent windows or subwindows. Multiple views offer designers a way to keep certain information visible, while other views are scrolled or replaced. For example, within the same window, one frame might display a static banner, a second a navigation menu, and a third the main document that can be scrolled through or replaced by navigating in the second frame."

An IFRAME attack is an IFRAME that injects malicious code onto web pages which usually redirects you to a third-party website, one that is sending you exploits or drive-by downloads, examples of which can be seen further in this article.

Now Dancho Danchev is reporting that not only are major sites Wired.com and History.com under attack, but educational and military sites, which are much smaller targets, are also being affected, as the Russian Business Network (RBN) seeks to spread its cyber-attack glue as far and wide across the web as possible in an attempt to illegally, immorally and unethically steal money and private information through malware and drive-by downloads.

Danchev says that: “Monitoring last week's IFRAME injection attack at high page rank-ed sites, reveals a simple truth, that persistent simplicity seems to work” – showing that the simple attacks in life are often the best, at least from an online criminal’s perspective.

So, are the attacks still underway, and should users be worried? Please read onto page 2.