Mass attack infects thousands of reputable sites

By

A new attack has infected hundreds of thousands of websites, including a United Nations site.




Mass attack infects thousands of reputable sites
Browsing to these normally safe websites will cause users to unknowingly load a file that automatically attempts to serve up a concoction of eight different exploits designed to gain access to their computer and install information-stealing malware. 

The attackers have used a new domain as their hub for hosting the malicious payload. The exploits target Microsoft applications, specifically browsers not patched against the VML exploit, as well as other applications.

“The problem with this attack is that it affects reputable sites,” Dan Hubbard, vice president of security research at Websense Security Labs told SCMagazineUS.com on Wednesday. He added, “If you have the latest fully patched version of Windows, there is little danger. The problem is that many users do not always run the latest patch updates.”

These attacks are among a growing number of recent attacks that take advantage of the flaws in traditional security solutions, solutions that rely on signatures and web reputation to protect customers.

By infecting hundreds of thousands of well-trafficked, well-known websites simultaneously, the attackers only need a window of a few hours to harvest a large number of potential victims. Web users and organisations without real-time protection may be vulnerable. 

See original article on scmagazineus.com
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

Service NSW centralises security, networking in mammoth CloudOps overhaul

Service NSW centralises security, networking in mammoth CloudOps overhaul

VicRoads to phase out passwords in favour of passkeys

VicRoads to phase out passwords in favour of passkeys

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Log In

  |  Forgot your password?