Gumblar compromise growth continues
Dominant web threat infecting still more vulnerable sites.
A major web compromise, estimated by some to represent over 40% of infected web pages last week, has continued
growing in size and prevalence at an alarming rate.
The threat, commonly dubbed 'Gumblar' after a domain used by early versions, but also known as 'JS/Redir', is thought to
inject itself into websites using stolen ftp credentials to hosting servers, and uses the infected pages to serve
malware which may seek out further ftp login data. It may also doctor Google search results to redirect
more victims to compromised hosts, which attempt to infect via PDF and Flash exploits.
The threat's sharp growth in size was highlighted last week by researchers at
Sophos and at
ScanSafe, and the spurt seems to have
continued with ever higher figures reported by a variety of sources. Mary Landesman at ScanSafe has kept up a
running commentary on the spread of the threat on the STAT blog here, with
more details on the threat itself at Unmask Parasites
here and
reports from US-Cert here
and SANS here.
20 May 2009
Tags:
compromise, exploit, vulnerability, web threat.
del.icio.us 
digg this
0 comments
This month's VB100 test saw some major changes and a radical overhaul of the VB100 test methodology - for the first time allowing products to use their 'cloud' look-up systems. John Hawes has all the details.