More than 60,000 websites hit by 'trojan cocktail'
A researcher has said the attack is similar to one used to steal credit and debit card numbers in a massive US breach last year.
A trojan cocktail' has hit legitimate websites in the UK and US, carrying a dangerous mix of backdoors, password stealers and downloader programs.
As of Friday, 55,000 websites had been affected, but this has now increased to 64,700, according to ScanSafe, the company that initially discovered the threat. This is around an eight per cent increase in just a few days.
The websites were affected as a result of an SQL injection attack. This is a way of tricking the database behind a website into responding to a normal search query as if it was a command to take some kind of action.
By tricking the database, the SQL injection attack tells the website to insert a malicious iframe onto its pages.
Once the legitimate website has been compromised, an intermediary site that hosts different exploits silently loads malicious content into the website while a user is browsing, looking for a vulnerability that it can take advantage of.
Once an exploit has been found, the trojan cocktail can be installed on a user's machine. Mac users can feel safe, as the cocktail is only targeting Windows PCs.
"The malware that is being downloaded consists of a backdoor, a trojan downloader and a keylogger," said senior ScanSafe researcher Mary Landesman speaking to IT PRO. "It all happens at the same time."
"This is the type of malware in terms of its inner workings very similar to what they had at Heartland Payment Systems," she added.
This was an incident in the US where the payments processor was the victim of a massive security breach, leaving customer transaction data and card numbers exposed.
Landesman said that there were a large number of UK sites that were impacted, which can be seen with a Google search on the iframe script tag. (It was advised that users should not click through unless they knew what they were doing).
Scrolling through the list, one of British websites affected included one belonging to the Royal College of General Practitioners.
Landesman said that in this particular attack, the attackers purposely avoided targeting government websites to avoid the type of the attention it could bring.
BCDR buyer's guide for MSPs
How to choose a business continuity and disaster recovery solutionDownload now
The definitive guide to IT security
Protecting your MSP and your customersDownload now
Cost of a data breach report 2020
Find out what factors help mitigate breach costsDownload now
The complete guide to changing your phone system provider
Optimise your phone system for better business resultsDownload now