More than 60,000 websites hit by 'trojan cocktail'

gallery

A ‘trojan cocktail’ has hit legitimate websites in the UK and US, carrying a dangerous mix of backdoors, password stealers and downloader programs.

As of Friday, 55,000 websites had been affected, but this has now increased to 64,700, according to ScanSafe, the company that initially discovered the threat. This is around an eight per cent increase in just a few days.

The websites were affected as a result of an SQL injection attack. This is a way of tricking the database behind a website into responding to a normal search query as if it was a command to take some kind of action.

By tricking the database, the SQL injection attack tells the website to insert a malicious iframe onto its pages.

Once the legitimate website has been compromised, an intermediary site that hosts different exploits silently loads malicious content into the website while a user is browsing, looking for a vulnerability that it can take advantage of.

Once an exploit has been found, the trojan cocktail can be installed on a user’s machine. Mac users can feel safe, as the cocktail is only targeting Windows PCs.

“The malware that is being downloaded consists of a backdoor, a trojan downloader and a keylogger,” said senior ScanSafe researcher Mary Landesman speaking to IT PRO. “It all happens at the same time.”

“This is the type of malware in terms of its inner workings very similar to what they had at Heartland Payment Systems,” she added.

This was an incident in the US where the payments processor was the victim of a massive security breach, leaving customer transaction data and card numbers exposed.

Landesman said that there were a large number of UK sites that were impacted, which can be seen with a Google search on the iframe script tag. (It was advised that users should not click through unless they knew what they were doing).

Scrolling through the list, one of British websites affected included one belonging to the Royal College of General Practitioners.

Landesman said that in this particular attack, the attackers purposely avoided targeting government websites to avoid the type of the attention it could bring.

Email to a friend

Print this page