Hackers step up search results attack

By

A malware attack targeting search engine results is continuing to haunt several high-profile sites..

Hackers step up search results attack
The attack uses the common cross-site scripting practice of embedding pages with small IFrame tags which redirect the user to a malicious page on a third-party site.

Researchers claimed that the latest attack is unique in that it targets search engine results.

The hackers have compromised search result pages, using search engine optimisation techniques to hijack search results and send users to sites which host malicious downloads.

Among the sites said to be compromised are major news outlets ABC, USAToday and Forbes, and retailers Wal-Mart, Target and Sears.

Security researcher Dancho Danchev said in a blog posting that the attacks have been lingering on the web for more than two weeks, despite efforts by Google to delete infected pages from its cache.

Danchev estimates that up to one million different search queries will lead users to the infected pages.

Administrators can protect against the attack by plugging the input validation vulnerabilities used to seed the malicious code within the pages.

But Danchev does not see the attacks slowing down anytime soon. "We are definitely going to see many other sites with high page ranks targeted by a single search engine results poisoning in combination with IFrame injections," he wrote.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Log In

  |  Forgot your password?