Malware strikes Jamie Oliver site for second time

Just weeks after the website was deemed safe, the vulnerability returns

Naked chef Jamie Oliver's website has been exposed by malware for the second time in less than a month.

Security researchers discovered the flaw on Friday, and although it was dealt with in minutes, some claimed it had been active for up to eight days.

Site visitors using Internet Explorer without up to date plug-ins for Java and Flash were redirected to another page that installed a virus called Dorkbot.ED, which monitors activity and which can steal passwords or log-in information.

"We have taken measures to clear the offending code and the site is now safe to visit. We are now running a forensic audit to find out more information," the site's operators said in a statement.

Security experts have suggested that this second attack was related to the first one, revealing administrators of Oliver's site may not have completely removed the malware from servers when it was first discovered back in February.

Malwarebytes, the security team who uncovered the first and now the second infection, suggested this was the case in a blog post.

Jerome Segura wrote: "It is indeed quite common for a hacked server to retain malicious shells or backdoors that keep on reinfecting the site.

"This is the same infection that was not completely removed or perhaps that a vulnerability with the server software or Content Management System (CMS) still exists."

Security researcher Graham Cluley agreed, writing in a blog post: "The site's administrators clearly failed to properly find what the security issue was with the site last time, and appears to have been compromised so easily again."

Malware still living in the server software or content management system means hackers can easily reinstate the flaw.

The team behind the website said in a statement: "The team at jamieoliver.com found a low-level malware problem and dealt with it quickly. The site is now safe to use. We have had only a handful of comments from users over the last couple of days, and no-one has reported any serious issues.

"We apologise to anyone who was at all worried after going on the site. The Jamie Oliver website is regularly checked for vulnerabilities by both our in-house team and an independent third-party and they quickly deal with anything that is found.

"The team is confident that no data has been compromised in this incident but if anyone is worried, do please use the contact form on the site."

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

How to encrypt files and folders in Windows 10
encryption

How to encrypt files and folders in Windows 10

9 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Evidence suggests REvil behind Harris Federation ransomware attack
ransomware

Evidence suggests REvil behind Harris Federation ransomware attack

9 Apr 2021
Fujitsu taps Trend Micro to secure private 5G networks in smart factories
5G

Fujitsu taps Trend Micro to secure private 5G networks in smart factories

8 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021