50,000 sites compromised in sustained attack

Powered by SC Magazine
 

WordPress, other plugins targeted.

Some 50,000 websites have been compromised as part of a sustained iframe injection attack campaign targeting vulnerable plug-ins for web servers and content management systems.

Attackers targeted holes in a string of plug-ins for blogging software — such as WordPress— including timthumb, uploadify and phpmyadmin.

When one was discovered, attackers would inject a malicious file and an iframe to link the compromised sites. Various browser-based attacks, including drive-by downloads, were also added.

At least 4000 new websites were infected each day, Sucuri malware researcher Daniel Cid told SC.

“So we believe that there are more than 50,000 sites compromised as part of this botnet,” Cid said.

“When all is said and done, you have a large network of compromised sites, all linking to each other and all with the same malware.”

He said a further 5000 were compromised today using the below malicious iframe.

 

 

Many of the queries probed for web hosting software Plesk, a finding backed by the Sans Internet Storms Centre that noted a sharp uptick in requests over port 8443, used by Plesk.

Vulnerabilities in WordPress plugins have been long understood. Last year, large malware campaigns including the LizaMoon attacks exploited those holes, while in November thousands of WordPress sites were hijacked through vulnerable instances of the TimThumb image resizer tool.

Copyright © SC Magazine, Australia


50,000 sites compromised in sustained attack
 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1037

Vote