Malware strikes Jamie Oliver site for second time

Just weeks after the website was deemed safe, the vulnerability returns

Naked chef Jamie Oliver's website has been exposed by malware for the second time in less than a month.

Security researchers discovered the flaw on Friday, and although it was dealt with in minutes, some claimed it had been active for up to eight days.

Site visitors using Internet Explorer without up to date plug-ins for Java and Flash were redirected to another page that installed a virus called Dorkbot.ED, which monitors activity and which can steal passwords or log-in information.

"We have taken measures to clear the offending code and the site is now safe to visit. We are now running a forensic audit to find out more information," the site's operators said in a statement.

Security experts have suggested that this second attack was related to the first one, revealing administrators of Oliver's site may not have completely removed the malware from servers when it was first discovered back in February.

Malwarebytes, the security team who uncovered the first and now the second infection, suggested this was the case in a blog post.

Jerome Segura wrote: "It is indeed quite common for a hacked server to retain malicious shells or backdoors that keep on reinfecting the site.

"This is the same infection that was not completely removed or perhaps that a vulnerability with the server software or Content Management System (CMS) still exists."

Security researcher Graham Cluley agreed, writing in a blog post: "The site's administrators clearly failed to properly find what the security issue was with the site last time, and appears to have been compromised so easily again."

Malware still living in the server software or content management system means hackers can easily reinstate the flaw.

The team behind the website said in a statement: "The team at jamieoliver.com found a low-level malware problem and dealt with it quickly. The site is now safe to use. We have had only a handful of comments from users over the last couple of days, and no-one has reported any serious issues.

"We apologise to anyone who was at all worried after going on the site. The Jamie Oliver website is regularly checked for vulnerabilities by both our in-house team and an independent third-party and they quickly deal with anything that is found.

"The team is confident that no data has been compromised in this incident but if anyone is worried, do please use the contact form on the site."

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021