iTnews

50,000 sites compromised in sustained attack

By Darren Pauli on Jul 10, 2012 1:27PM
50,000 sites compromised in sustained attack

WordPress, other plugins targeted.

Some 50,000 websites have been compromised as part of a sustained iframe injection attack campaign targeting vulnerable plug-ins for web servers and content management systems.

Attackers targeted holes in a string of plug-ins for blogging software — such as WordPress— including timthumb, uploadify and phpmyadmin.

When one was discovered, attackers would inject a malicious file and an iframe to link the compromised sites. Various browser-based attacks, including drive-by downloads, were also added.

At least 4000 new websites were infected each day, Sucuri malware researcher Daniel Cid told SC.

“So we believe that there are more than 50,000 sites compromised as part of this botnet,” Cid said.

“When all is said and done, you have a large network of compromised sites, all linking to each other and all with the same malware.”

He said a further 5000 were compromised today using the below malicious iframe.

 

 

Many of the queries probed for web hosting software Plesk, a finding backed by the Sans Internet Storms Centre that noted a sharp uptick in requests over port 8443, used by Plesk.

Vulnerabilities in WordPress plugins have been long understood. Last year, large malware campaigns including the LizaMoon attacks exploited those holes, while in November thousands of WordPress sites were hijacked through vulnerable instances of the TimThumb image resizer tool.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:
exploits security vulnerabilities

Partner Content

Shut the door on ransomware
Promoted Content Shut the door on ransomware
Preventing cybercrime in the world of forex trading
Promoted Content Preventing cybercrime in the world of forex trading
COVID puts agile IT under the microscope
Promoted Content COVID puts agile IT under the microscope
Improving returns from SD-WAN spending
Partner Content Improving returns from SD-WAN spending

Sponsored Whitepapers

The top 5 tech trends to deliver business outcomes
The top 5 tech trends to deliver business outcomes
10 reasons why businesses need to invest in cloud security training
10 reasons why businesses need to invest in cloud security training
Your guide to application security solutions
Your guide to application security solutions
State of Software Security: Open Source Edition
State of Software Security: Open Source Edition
Five questions to ask before you upgrade to a SIEM solution
Five questions to ask before you upgrade to a SIEM solution

Events

  • On-Demand Webinar: How Poly and Microsoft are Embracing Future Work Environments
  • [iTnews and Micro Focus] Navigating the cloud modernisation minefield
By Darren Pauli
Jul 10 2012
1:27PM
0 Comments

Related Articles

  • US authorities charge alleged Netwalker ransomware affiliate
  • Police take over global Emotet infrastructure
  • Ransomware gang Ryuk thought to have pulled in US$150 million
  • FireEye, GoDaddy and Microsoft flick SolarWinds SUNBURST 'killswitch'
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

TPG Telecom to start enticing NBN customers to move

TPG Telecom to start enticing NBN customers to move

Infosys scores another $40m for Centrelink payments engine build

Infosys scores another $40m for Centrelink payments engine build

Telstra InfraCo opens up telco's own fibre network

Telstra InfraCo opens up telco's own fibre network

Transport for NSW data stolen in Accellion breach

Transport for NSW data stolen in Accellion breach

You must be a registered member of iTnews to post a comment.
Log In | Register
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.