[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ISN] Expedia.com, Rhapsody.com serving up malicious code
By Ellen Messmer
Legitimate Web sites are increasingly becoming unwitting sources of
malware. Security experts report that Expedia.com and Rhapsody.com today
have been serving up banner ads that attempt to get visitors to download
fake antispyware, while embassy Web sites in Ukraine and Russia have
also been spewing out attack code this week.
"Expedia and Rhapsody are both serving up Shockwave ads with malicious
code," says Jamz Yaneza, research project manager at Trend Micro, which
has shared its findings with both online e-commerce companies.
At Expedia.com, a banner with malware dubbed SNF_ADHIJACK.A has tried to
direct anyone who clicks on it to a site to install a Trojan called
TROJ_GIDA.A, Yaneza says.
"These Shockwave banner ads being served are malicious," says Yaneza,
who notes that the content banner may appear to be from a legitimate
source. (Learn more about antispyware products in our Antispyware
Earlier this week, the Web sites for the Embassy of the Ukraine in
Lithuania, the Embassy of the Netherlands in Russia, and the Ministry of
Foreign Affairs for the country of Georgia were all found to be
compromised and serving up attack code to visitors.
"We know these Web sites have been compromised," says Ofer Elzam,
director of product management for Aladdin Knowledge Systems' eSafe
division. "They're trying to infect the visitor's PC to turn it into a
proxy using an iFrame exploit."
Elzam says Alladin Knowledge Systems has submitted its findings to these
embassies. He notes the type of attack used against these Web sites
bears some similarity to the well-known Alicia Keyes MySpace compromise.
A report recently published by WebSense addresses the issue of
legitimate sites being hacked and turned into malware-emitting sites.
The WebSense report claims that 51% of sites it classified as malicious
in the second half of 2007 had been compromised by attack code. The
remaining 49% were intentionally designed to propagate malware.
All contents copyright 1995-2008 Network World, Inc
Subscribe to InfoSec News