Subject: Web Site Compromises
Source: CNET
Complete Item:
'Gumblar' attacks spreading quickly | Security - CNET News
Description:
The attackers behind a series of rapidly spreading Web site compromises have begun using a new domain to deliver their malicious code, security experts say.

The attacks, collectively referred to as "Gumblar" by ScanSafe and "Troj/JSRedir-R" by Sophos, grew 188 percent over the course of a week, ScanSafe said late last week. The Gumblar infections accounted for 42 percent of all infections found on Web sites last week, Sophos said.

Over the weekend, the Chinese Web domain used to deliver the malicious code--gumblar.cn--stopped responding, according to Unmask Parasites, a service used to detect malicious code embedded in Web pages. The attacks' malicious payload has, however, continued to be delivered from a different source, the martuz.cn domain, Unmask Parasites said Monday in an advisory.

"They have slightly modified the script and now inject a new version that loads malicious content from a new domain," Unmask Parasites said.

Changes to the script make it more difficult to identify and stop detection by the Google Chrome browser, Unmask Parasites said.

Gumblar was first detected in March and has spread more quickly since then, against the expectations of security experts.

"A typical series of website compromises reaches peak within the first week or so and subsequently begins declining in intensity as detection is added by signature vendors, user awareness increases and website operators begin cleaning the affected sites," ScanSafe senior security researcher Mary Landesman, said late last week in an advisory.

In the Gumblar attacks, the opposite is occurring, partly because Web site administrators themselves are affected by the attacks as they try to address the problem, ScanSafe said.

Sites affected include Tennis.com, Variety.com, and Coldwellbanker.com, according to ScanSafe.

Posted by John B. Frank Sunday, May 24, 2009

4 comments

  1. Anonymous Says:
  2. For those who have been affected by Gumbler or the more recent Nine-Ball, www.iframehack.com provides services to help remove the offending code from your website and will assist in the process of having your site reviewed by Google and the "malware warning" label removed.

     
  3. Anonymous Says:
  4. For those who have been affected by Gumbler or the more recent Nine-Ball, www.iframehack.com provides services to help remove the offending code from your website and will assist in the process of having your site reviewed by Google and the "malware warning" label removed.

     
  5. Anonymous Says:
  6. I got rid of this virus with the help of following article

    http://www.qualitycodes.com/tutorial.php?articleid=29

     
  7. Note that this malware can steal FTP passwords used on clean computers. Maybe that's a factor in its big success...

     

Payments Industry News Blog

Search the PIN Debit Blog by Subject

Kapersky Calls for Mass Adoption of Card Readers

Kapersky Calls for Mass Adoption of Card Readers