Virus variant targets Google
688960
A new variant of the Zafi virus attacks Google, Microsoft, and the Hungarian Prime Minister
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
348448
Google has responded to calls from antivirus firms to stop the spread of an Internet worm that was using the search engine&#39;s technology to spread among online bulletin boards.
741740
A new variant of the MyDoom virus is designed to launch a denial-of-service attack against antivirus software maker Symantec, according to security firm Sophos.
40526
Google's PC search software is vulnerable to a variation on a little-known Web-based attack called anti-DNS (Domain Name System) pinning, that could give an attacker access to any data indexed by Google Desktop, security researchers said this week.
615818
A new worm has been detected that uses Google to find vulnerable phpBB forums. The worm - named Net-Worm.Perl.Santy.a - queries Google to find sites using outdated versions of the phpBB forum software which can be exploited.
624271
New variant offers holiday greetings before infecting your PC with a virus.
193142
The Santy worm, which searches Google for sites that use a vulnerable version of the search engine&#39;s technology, is being tackled by Google.
236014
A new Trojan horse modifies infected PC's hosts file to replace Google text ads with ads from another source.
191592
(InfoWorld) - Web sites running Microsoft's Web server software are twice as likely to be hosting malicious code as other Web sites, according to research from Google. Last month, Google's Anti-Malware team looked at 70,000 domains that were either distributing malware or hosting attack code and made the finding. "Compared to our sample of servers across the Internet, Microsoft IIS features twice as often as a malware-distributing server," wrote Google's Nagendra Modadugu, in a Tuesday blog posting. Together, IIS (Internet Information Services) and Apache servers host about 89 percent of all Web sites, but collectively, they're responsible for 98 percent of all Web-based malware. Google actually found an equal number of Apache and IIS Web sites hosting malicious software, but because there are so many more sites hosted by Apache servers (66 percent versus Microsoft's 23 percent) malicious sites make up a much larger percentage of all IIS servers. Modadugu didn't draw any conclusions about whether this means that Microsoft servers are more likely to be hacked. "It is important to note that while many servers serve malware as a result of a server compromise ... some servers are configured to serve up exploits by their administrators," Modadugu wrote. Google also found that the malware server of choice varied from region to region. In China and South Korea, for example, the majority of malicious Web sites are running IIS. In the U.S., Russia, and Germany, however, Apache is the predominant malware server. Modadugu speculated that the servers in China and South Korea may be running pirated software and thus unable to get Microsoft's latest security updates. According to one security researcher, the fact that IIS is so easy to use may account for Google's findings. It's easier to operate an ISS Web server than an Apache Web server, said Cesar Cerrudo, CEO of security research firm Argeniss. "People who are not too skilled will install Windows and set up a Web server with weak configuration." But Cerrudo said that more information would be required to draw any solid conclusions about the security of IIS. "The report says that 70,000 domains were examined, but what about if 5,000 domains are in the same Web server in China?" he asked. "It's pretty easy playing with numbers and concluding. A lot of more data is needed to get the right conclusions." Microsoft and Apache did not immediately respond to messages seeking comment.
116333
Google acted quickly to block Santy.A, a worm that targeted the company&#39;s popular Internet search engine. Antivirus experts say this threat has passed, but predict that it may be just
367696
Engineers at Hewlett-Packard Co. are working on &quot;virus-throttling&quot; software that they say could slow the spread of Internet-borne viruses and worms.
522864
Security researchers say Google may be on to something with its research on whether IIS servers are more likely to be vulnerable to malware. But there could be a plethora of reasons why that's the case.
214459
Engineers at Hewlett-Packard Co. are working on "virus-throttling" software that they say could slow the spread of Internet-borne viruses and worms.
108469
Days after Google acted to thwart the Santy worm, security firms warned that variants have begun to spread using both Google and other search engines.
239180
User-generated Web content is becoming a target for hackers and cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites.
504539
Hewlett-Packard is working on software that it says could slow the spread of Internet-borne worms and viruses, AP reports. Researchers at the company say the new âvirus-throttlingâ software would not destroy