May 20, 2009, 2:02 PM — An old friend has been back in the headlines this week - Gumblar aka Troj/JSRedir-R. Can't see why that name didn't catch on...
Anyway, it's back, and it's getting smarter.
Gumblar is a trojan/downloader. It doesn't do anything nasty on its own, it's just the tool for getting malware onto user's PCs. Until now, it is this end of the problem that has been frequently addressed.
For businesses, however, the real threat is not compromised PCs. True, this is no fun at all, but almost everyone is running desktop antivirus, and I would hope most organizations have some sort of web filtering with malware protection. No, the biggest threat to businesses is becoming a malware host.
For many businesses the web is their shop window. If their website becomes a malware host, it could cause massive damage to their online profile. Not only are they likely to be blacklisted by public-spirited search engines and other filtering systems, but their reputation may suffer as people work out where and how they were infected.
Small and medium businesses are more likely to suffer these attacks than any other: those with sites with sufficient visibility, and insufficient security. Some reports suggest that compromised FTP (1985 called, it wants its protocol back) passwords were to blame for many of the infected sites. From experience though, I would suggest that these clever guys will have more than one way to crack that nut. Forum software and Content Management Systems are prime targets: easily spotted, and usually helpfully accompanied by a version number. If there are known exploits you are extremely vulnerable.
Here are some top tips for webmasters:
1. If you are using FTP, stop. Think. Ask your webhost if there's a more secure alternative, SFTP for example.
2. If you are using "off the peg" CMS or forum software, keep it up-to-date, and be aware of new vulnerabilities.
3. Keep on top of your passwords - don't save them, unless you encrypt them, and make sure you are aware of all of them, many site components have default passwords.
