May 12, 2008, 4:06 PM — More than half a million Web sites have been compromised in a new round of
attacks that hacked domains in order to infect unsuspecting users' PCs with
a variety of malware, a security researcher said today.
"This is an on-going campaign, with new domains [hosting the malware]
popping up even this morning," said Paul
Ferguson, a network architect with anti-virus vendor Trend
Micro. "The domains are changing constantly."
According to Ferguson, over half a million legitimate Web sites have been hacked
by today's mass-scale attack, only the latest in a string that goes back to
at least January. All of the sites, he confirmed, are running "phpBB,"
an open-source message forum manager.
Ferguson didn't know how the sites were compromised; Trend Micro's investigation
is in progress, he said. "We're not sure if it's [because of] improper
configuration of phpBB or a vulnerability. Open-source applications like phpBB
tend to be targeted quite a bit."
Visitors to a hacked site are redirected through a series of servers, some
clearly compromised themselves, until the last in the chain is reached; that
server then pings the PC for any one of several vulnerabilities, including bugs
in both Microsoft
Corp.'s Internet Explorer and RealNetworks
Inc.'s RealPlayer media player. If any of the vulnerabilities is present,
the PC is exploited and malware is downloaded to it.
Some of the compromised sites have been hijacked before, said Ferguson. "Some
had recently been used for keyword search ranking manipulation, and others to
pitch fake pharmaceuticals or just malware," he said.
While other research by Trend Micro identified the malware hitting users' PCs
as a variant of the Zlob Trojan horse, Ferguson said that more than just one
piece of malware is being served. "We seeing some new stuff coming out
of this one," he said.
The last
massive site attack was less than three weeks ago, when sites that included
government URLs in the U.K. and some domains operated by the United Nations
were hacked. At the time, some researchers said that bugs in Microsoft's SQL
Server or Internet
Information Services (IIS) server software was to blame. A few days later,
however, Microsoft
denied responsibility.
Don't expect the run of site infections to stop anytime soon, said Trend Micro's
Ferguson. "As long as attacks are tied to site development and as long
as sites don't secure their content, we'll see these attacks," he said.
