[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ISN] Hacked embassy websites found pushing malware
By Dan Goodin in San Francisco
23rd January 2008
Add embassy websites to the growing list of hacked internet destinations
trying to infect visitor PCs with malware.
Earlier this week, the site for the Netherlands Embassy in Russia was
caught serving a script that tried to dupe people into installing
software that made their machines part of a botnet, according to Ofer
Elzam, director of product management for eSafe, a business unit of
Aladdin that blocks malicious web content from its customers' networks.
In November the Ministry of Foreign Affairs of Georgia and Ukraine
Embassy Web site in Lithuania were found to be launching similar
attacks, he says.
All three sites had been hacked to include invisible iframes that
initiated a chain of links that ultimately connected to servers hosting
malicious code, which was heavily obfuscated to throw off antivirus
systems. The similarities led eSafe researchers to conclude the attacks
were carried out by the same group. Elzam speculates the group has ties
to organized crime in Eastern Europe.
The findings come as Websense, a separate security firm that's based in
San Diego, recently estimated that 51 per cent of websites hosting
malicious code over the past six months were legitimate destinations
that had been hacked, as opposed to sites specifically set up by
criminals. Compromised websites can pose a greater risk because they
often come with a degree of trust.
Stories reporting security vulnerabilities frequently carry the caveat
that an attacker would first need to lure a victim to a malicious
website. Poisoning the pages of a legitimate embassy or ecommerce
website would be one way to carry that out.
Frequently, the compromised websites launch code that scours a visitor's
machine for unpatched vulnerabilities in Windows or in applications such
as Apple's QuickTime media player. Such was the case in two recent
hacking sprees (here  and here ) that affected hundreds of
thousands of sites, including those of mom-and-pop ecommerce companies
and the City of Cleveland.
But in the case of the Netherlands Embassy, the attackers simply
included text that instructed visitors to download and install the
malware. Of course, no self-respecting Reg reader would fall for such a
ruse. But sadly, Elzam says, because the instruction is coming from a
trusted site, plenty of less savvy users do fall for the ploy. Saps.
"Using social engineering is almost fool proof," he says. "My mother
would fall for that because she is really conditioned to click on OK
when she's asked to do something like that."
Subscribe to InfoSec News