RSS Alerts

Share

More services

Related Stories

  • Breaking the Online Bank
    As technology and online behaviors change, so too do methods to compromise a person’s – or organization’s – most vital assets: their financial details. Ted Kritsonis examines how cyber thieves are adapting, and what the banks are doing to stop them
    Members' Content
  • Symantec reports polymorphic malware soaring to 72% during September
    The latest monthly analysis from Symantec claims to show that around 72% of all email-borne malware seen so far in September have been characterized as aggressive strains of generic polymorphic malware – up from just 23.7% tracked during July of this year.
  • Out-of-date browser plug-ins are attractive targets for cybercriminals
    Out-of-date browser plug-ins are prime targets for cyberattacks against enterprise browsers, according to Zscaler’s State of the Web report for the second quarter of 2011.
  • New website tackles challenges of intelligent whitelisting technology
    Lumension is sponsoring a new website to share insights into intelligent whitelisting technology to improve organizations’ information security.
  • Iranian Cyber Army offers its botnet for rental
    The Seculert Research Lab is reporting that a hacktivist group called the Iranian Cyber Army is renting out access to its botnet. Although not the first time a botnet has been put up for rent – the first known botnet/crimeware renter was BadB in the early noughties – this is one of the most high-profile 'offers' seen to date.

Top 5 Stories

News

McCartney site serves up Zeus malware

08 April 2009

Paul McCartney's site was serving up the Zeus trojan for three days, according to UK security firm ScanSafe. The attack, in which paulmccartney.com was compromised with malicious Javascript, appears to have been tailored to coincide with interest in his New York reunion concert last weekend.

ScanSafe first noticed its customers receiving the Javascript when visiting the site at 12:30 GMT on Saturday. Attackers had embedded a malicious IFRAME into the site, along with malicious Javascript that used a unique multi-layer obfuscation attack, said ScanSafe's director of product management Spencer Parker.

"There is no other web site, of the billion or so we've visited as part of our service, that's ever done something like this before," Parker said. The Javascript used different character encoding to cloak itself, and also send an SSL certificate to the browser to encrypt its payload.

The IFRAME and Javascript directed the victims' machine to a single IP address (84.244.138.55) based in Amsterdam, which has now been shut down. Reverse IP lookups reveal no information about the site, but it showed up on a malicious IP list.

The IP address hosted the LuckySploit toolkit, which looks for multiple vulnerabilities on target machines, including the recently-patched Adobe PDF bug. Once a vulnerability has been found, the toolkit is believed to have delivered the Zeus trojan onto victims' machines.

The quick shutting down of the IP address, in conjunction with the reunion concert, suggests that the attack was designed to harvest the maximum possible amount of traffic.

"They do time their attacks very well. When the hackers find a way to exploit one of these sites and get their code embedded on the page, they will always try and time that for maximum effect," Parker said. "And like a lot of attacks at the moment, it's based on embedding a very small amount of code on the site."

Statbrain, which estimates web traffic to external sites, thinks that www.paulmccartney.com has been getting almost 5,000 hits per day. Alexa shows a slight uptick in traffic over the weekend.

ScanSafe said that McCartney's team appeared to have cleaned up the site sometime after 7:30pm GMT on Monday. Earlier yesterday, Google searches were still listing the site as potentially harmful. By yesterday evening, searches were coming up clean.

This article is featured in:
Internet and Network Security • Malware and Hardware Security

 

Comment on this article

You must be registered and logged in to leave a comment about this article.

Terms & Conditions |Privacy |Website Design|Reed Exhibitions. All rights reserved. Copyright © 2012