Hackers attack Google blogging site

Google's blogging website Blogger.com is susceptible to cross-site scripting attacks by hackers, according to research carried out by IT security company Fortinet.

The company said malicious scripts have shown up on hundreds of blog pages and in some cases, the Stration mass mailer worm is responsible for driving traffic to these sites.

Researchers at the company's threat response team said that the malcode has appeared in many different forms. A "storefront" for Pharmacy Express, redirects from a Blogger.com link, but the pharmacy site is in fact a phishing site designed to steal personal details and financial information from visitors.

Another script downloads a 1x1 pixel image to track the browser information, such as, IP address, browser type and version. While the Pharmacy Express site is hosted in China, the 1x1 pixel image is hosted on a site registered in the US.

Researchers said the proliferation of the phishing site has been very aggressive in spreading via mass mailers.

The team found that Blogger.com sites that have themselves been compromised with malicious code. One example, a blog site for a Honda CR450 enthusiast, was found to be carrying the Wonka trojan, and it was shown t link to a web tracking website in Russia. Although traffic was not directed to this site through spam, the team said it did show up in blog search engines.

Bryan Lu, of the threat response team at Fortinet who uncovered the vulnerability said that because of the sheer popularity of the blogging site, the effects of this malicious code to the unsuspecting user can be really important.

"Such threats to a social networking tool of this kind, clearly indicates that social engineering activity is continuing to thrive in the cybercrime community," said Lu.

"Perhaps more worrying than the phishing and spamming techniques used here, is the corruption of the blogging site itself. Creatively, any popular topic - from Star Wars to Christmas - in a blog search engine can be used to inject malicious scripts onto a surfer's machine," he warned.

Email to a friend

Print this page