New mass hack strikes sites, confounds researchers

Hack may be related to November break-in at UK hosting service Fasthosts Internet

A massive hack of legitimate Web sites has been spreading malware to visitors' PCs, using a new tactic that has made detection "extraordinarily difficult," security experts said Monday.

According to the researcher who broke the news, the hack, which involves several hundred sites, may be related to a November 2007 break-in at Fasthosts Internet, a UK-based hosting service that in early December acknowledged that some clients' log-in credentials had been pinched.

"All of the affected domains either have or have had a relationship in the recent past with Fasthosts," said Mary Landesman, a senior security researcher at ScanSafe Inc.

Like the large-scale hack prompted by a series of SQL injection attacks last week, the sites identified by ScanSafe are legitimate URLs, many of them small mom-and-pop e-commerce sites. Among them are a bicycle shop and several tightly focused travel sites, said Landesman. Most, although not all, are businesses located in the U.K.

But in almost every other way, this was a different, and much more sophisticated, attack. "Usually, in an attack like this, code is injected into the [site] pages, and that code is static," Landesman explained. "In these, it's completely different. The JavaScript that was being created and the reference [to it] was being generated dynamically."

That has given researchers, including Landesman, fits. In typical attacks, such as the SQL injection mass compromise, researchers can easily capture the attack code, analyze it and even use Google to search for other infected sites. Not so in this case.

"The method made it extremely difficult to tell who else might be impacted," Landesman said. "Here, the JavaScript was being generated dynamically and the file name was random, so we didn't have a common denominator. From a forensics standpoint, that hampers things greatly."

Paul Ferguson, network architect at Trend Micro, seconded that. "It makes it extraordinarily difficult," he said.

The timing of those first attacks and the network break-in of Fasthosts was no coincidence, Landesman said. "The timing is what made me wise to the Fasthosts security breach," she said. "We've seen this attack vector only a couple of times since November 2007," the same month Fasthosts said it first noticed the theft of clients' passwords and usernames. "Timing is everything."

She speculated that, once armed with access to sites managed by Fasthosts -- the company's breach notification specifically mentioned that FTP passwords had been snatched -- criminals planted malware on the servers that they only recently activated. "Other malware is involved" that has aided and abetted the sites' hacks, said Landesman.

Visitors to the compromised domains have been assaulted with multiple exploits, notably one for a vulnerability in Apple's QuickTime media player that was patched only last month. Another exploit being served, said Landesman, is the "tried and true" attack against Windows 18-month-old MDAC flaw.

If successful, the client-side attack infects the PC with a variation of the Rbot Trojan, a backdoor also known as Zotob that has been active since the middle of 2005. There, too, however, users are at special risk. "Just three out of 33 antivirus vendors detected that [variation]," Landesman claimed.

To top it all off, this hack's impact is magnitudes larger than the SQL injection's. "That accounted for just 1% of the blocks [ScanSafe instituted for its customers]," Landesman said. "This [new] one accounts for 18% of all blocks. That's a pretty tremendous number."

Fasthosts did not respond to a request for comment on a possible connection between its 2007 breach and the recent site compromises.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Family Friendly

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Stocking Stuffer

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?