The attackers behind a series of rapidly spreading website compromises have begun using a new domain to deliver their malicious code, security experts said on Monday.
The attacks, collectively referred to as 'Gumblar' by ScanSafe and 'Troj/JSRedir-R' by Sophos, grew 188 percent over the course of a week, ScanSafe said on Thursday. The Gumblar infections accounted for 42 percent of all infections found on websites last week, Sophos said on Thursday.
Over the weekend, the Chinese web domain used to deliver the malicious code — gumblar.cn — stopped responding, according to Unmask Parasites, a service used to detect malicious code embedded in web pages. The attacks' malicious payload has, however, continued to be delivered from a different source, the martuz.cn domain, Unmask Parasites said in an advisory published on Monday.
"They have slightly modified the script and now inject a new version that loads malicious content from a new domain," Unmask Parasites said in the advisory.
Changes to the script make it more difficult to identify and stop detection by the Google Chrome browser, Unmask Parasites said.
Gumblar was first detected in March and has spread more and more quickly since then, against the expectations of security experts.
"A typical series of website compromises reaches peak within the first week or so and subsequently begins declining in intensity as detection is added by signature vendors, user awareness increases and website operators begin cleaning the affected sites," said ScanSafe senior security researcher Mary Landesman, in an advisory published on Thursday.
In the Gumblar attacks, the opposite is occurring, partly because website administrators themselves are affected by the attacks as they try to address the problem, ScanSafe said.
Read this
Why scammers find rich pickings on Facebook
People shed their normal caution on social-networking sites, leaving the scammers and worm-writers to rub their hands with glee...
Sites affected include Tennis.com, Variety.com and Coldwellbanker.com, according to ScanSafe.
The attacks were carried out in multiple stages, beginning in March, when a number of websites were compromised and attack code embedded within them, ScanSafe said.
Then, in early May, as website operators began to clean up their sites, the attackers replaced the original malicious code with dynamically generated and heavily obfuscated JavaScript, meaning that the scripts change from page to page and are difficult for security tools to spot.
The scripts attempt to exploit vulnerabilities in Adobe's Acrobat Reader and Flash Player to deliver code that injects malicious search results when a user searches Google on Internet Explorer, ScanSafe said.
They also search the victim's system for FTP credentials that can be used to compromise further websites, the firm said.
The malicious code embedded on a user's system was previously downloaded from gumblar.cn, a Chinese domain associated with Russian and Latvian IP addresses, delivering code from servers based in the UK, according to ScanSafe. That domain has now changed to martuz.cn.
Talkback
An old friend has been back in the headlines this week - Gumblar aka Troj/JSRedir-R. Can't see why that name didn't catch on...
Anyway, it's back, and it's getting smarter.
Gumblar is a trojan/downloader. It doesn't do anything nasty on its own, it's just the tool for getting malware onto user's PCs. Until now, it is this end of the problem that has been frequently addressed.
For businesses, however, the real threat is not compromised PCs. True, this is no fun at all, but almost everyone is running desktop antivirus, and I would hope most organisations have some sort of web filtering with malware protection. No, the biggest threat to businesses is becoming a malware host.
For many businesses the web is their shop window. If their website becomes a malware host, it could cause massive damage to their online profile. Not only are they likely to be blacklisted by public-spirited search engines and other filtering systems, but their reputation may suffer as people work out where and how they were infected.
Small and medium businesses are more likely to suffer these attacks than any other: those with sites with sufficient visibility, and insufficient security. Some reports suggest that compromised FTP (1985 called, it wants its protocol back) passwords were to blame for many of the infected sites. From experience though, I would suggest that these clever guys will have more than one way to crack that nut. Forum software and Content Management Systems are prime targets: easily spotted, and usually helpfully accompanied by a version number. If there are known exploits you are extremely vulnerable.
My top tips for webmasters:
1. If you are using FTP, stop. Think. Ask your webhost if there's a more secure alternative, SFTP for example.
2. If you are using "off the peg" CMS or forum software, keep it up-to-date, and be aware of new vulnerabilities.
3. Keep on top of your passwords - don't save them, unless you encrypt them, and make sure you are aware of all of them, many site components have default passwords