[ISN] Expedia.com, Rhapsody.com serving up malicious code

From: InfoSec News (alerts@private)
Date: Thu Jan 31 2008 - 01:03:26 PST


http://www.networkworld.com/news/2008/013008-expedia-rhapsody-malware.html

By Ellen Messmer
Network World
01/30/08

Legitimate Web sites are increasingly becoming unwitting sources of 
malware. Security experts report that Expedia.com and Rhapsody.com today 
have been serving up banner ads that attempt to get visitors to download 
fake antispyware, while embassy Web sites in Ukraine and Russia have 
also been spewing out attack code this week.

"Expedia and Rhapsody are both serving up Shockwave ads with malicious 
code," says Jamz Yaneza, research project manager at Trend Micro, which 
has shared its findings with both online e-commerce companies.

At Expedia.com, a banner with malware dubbed SNF_ADHIJACK.A has tried to 
direct anyone who clicks on it to a site to install a Trojan called 
TROJ_GIDA.A, Yaneza says.

"These Shockwave banner ads being served are malicious," says Yaneza, 
who notes that the content banner may appear to be from a legitimate 
source. (Learn more about antispyware products in our Antispyware 
Buyer's Guide.)

Earlier this week, the Web sites for the Embassy of the Ukraine in 
Lithuania, the Embassy of the Netherlands in Russia, and the Ministry of 
Foreign Affairs for the country of Georgia were all found to be 
compromised and serving up attack code to visitors.

"We know these Web sites have been compromised," says Ofer Elzam, 
director of product management for Aladdin Knowledge Systems' eSafe 
division. "They're trying to infect the visitor's PC to turn it into a 
proxy using an iFrame exploit."

Elzam says Alladin Knowledge Systems has submitted its findings to these 
embassies. He notes the type of attack used against these Web sites 
bears some similarity to the well-known Alicia Keyes MySpace compromise.

A report recently published by WebSense addresses the issue of 
legitimate sites being hacked and turned into malware-emitting sites. 
The WebSense report claims that 51% of sites it classified as malicious 
in the second half of 2007 had been compromised by attack code. The 
remaining 49% were intentionally designed to propagate malware.

All contents copyright 1995-2008 Network World, Inc


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn 



This archive was generated by hypermail 2.1.3 : Thu Jan 31 2008 - 01:12:42 PST