Australian site under IFRAME attack, along with Wired and History.com

Alex Zaharov-Reutt
Tuesday, 11 March 2008 09:02

Your IT - Home IT

At the time of Danchev’s post, which was earlier today, he says that: “The attack is still ongoing, this time successfully injecting a multitude of new domains into Wired Magazine, and History.com's search engines, which are again caching anything submitted, particularly not validated input to have the malicious parties in the face of the RBN introducing a new malware, in between the pharmaceutical scams that they serve on the basis of an affiliation model.” and in answer to our question on ‘who’s next’, Danchev says that “in terms of high-profile sites, that is Wired.com and History.com.”

Danchev notes that “the same malicious parties behind the CNET and TorrentReactor's IFRAME injection are also the ones behind Wired.com and History.com's abuse of input validation.”

He continues that: “The IFRAME injection entirely relies on the lack of input validation within their search engines, making executable code possible to submit and therefore automatically execute upon accessing the cached page with a popular search query

Danchev notes some other key findings:

“Many other domains have been introduced within the IFRAMEs, a complete list of which you can find in this post, several directly hosted within RBN's network.”

“The main domain serving the heavily obfuscated VBS malware is located within the Russian Business Network's known netblocks.”

“Given the high page ranks of the current and the previous targets, it is evident that the malicious parties are prioritizing based on the possibility to abuse input validation on high page rank-ed sites, presumably in an automated fashion.”

“Keep it Simple Stupid works, as since they cannot find a way to embed the IFRAME at these hosts, a clear indicating of the fact that they've breached them, they figured out a way to inject the IFRAMEs and again take advantage of the high page ranks to attract traffic by gaining on popular key words, or any kind of key words that they want to.”

Danchev discloses that it’s not just Wired.com and History.com that are under attack, but also The University of Melbourne at uninews.unimelb.edu.au, and the following other .edu sites: hcc.cc.gatech.edu, buffalo.edu, uvm.edu, jurist.law.pitt.edu, one military site: fhp.osd.mil, and two torrent sites: bushtorrent.com and torrentportal.com.

Please read onto page 3 for more detail on where the attacks are originating from.