'Gumblar' attack explodes across the web

Known unofficially as 'Gumblar' for one of the attack domains, the malware is raising eyebrows and alert levels both for its prolific attack methods and for the danger of its payload.

According to researchers, the attack is spreading through site compromises which inject malicious javascript code within components of the site. Upon visiting the infected pages, a victim runs the risk of the javascript attack.

Once a site compromised, the malware alters access credentials and folder permissions to allow an attacker a 'back door' for entry to the site even when the user has changed passwords. The malicious javascript code is also altered in slight ways, preventing administrators from automatically searching out and deleting the malicious scripts.

Because the infection is so hard to get rid of, researchers say that Gumblar has enjoyed far more success than previous malware attacks.

First detected in late March, researchers thought that the attacks had been halted by mid April when Google delisted the offending sites.

However, a new variant on the attack arose early this month and has since enjoyed nearly unprecedented success. Security firm ScanSafe estimates that Gumblar attacks have jumped some 188 per cent over the last week alone, and Sophos credits Gumblar with up to 42 per cent of all malware infections in the last seven days.

"The gross infection rate is exceptional, especially this late in the game," said Mary Landesman, senior security researcher at ScanSafe.

"Basically, it has been enjoying free reign."

The malware payload itself is also believed to be highly dangerous.

Landesman told vnunet.com that the malware intercepts web traffic such as Google search requests and redirects it to present fraudulent results, allowing the attackers to collect referral fees and placing the user at risk for further infection.

Additionally, she noted that the malware contains botnet controllers and is programmed to collect all FTP permissions on the infected systems, allowing Gumblar to infect any sites which the user administrates, further fostering the spread to new domains.