Channel Register

Original URL: http://www.channelregister.co.uk/2008/01/23/embassy_sites_serve_malware/

Hacked embassy websites found pushing malware

By Dan Goodin in San Francisco
Published Wednesday 23rd January 2008 21:46 GMT

Add embassy websites to the growing list of hacked internet destinations trying to infect visitor PCs with malware.

Earlier this week, the site for the Netherlands Embassy in Russia (http://www.netherlands.ru/) was caught serving a script that tried to dupe people into installing software that made their machines part of a botnet, according to Ofer Elzam, director of product management for eSafe (http://www.aladdin.com/esafe/default.aspx), a business unit of Aladdin that blocks malicious web content from its customers' networks. In November the Ministry of Foreign Affairs of Georgia (http://mfa.gov.ge/) and Ukraine Embassy Web site (http://ukrembassy.5ci.lt/) in Lithuania were found to be launching similar attacks, he says.

All three sites had been hacked to include invisible iframes that initiated a chain of links that ultimately connected to servers hosting malicious code, which was heavily obfuscated to throw off antivirus systems. The similarities led eSafe researchers to conclude the attacks were carried out by the same group. Elzam speculates the group has ties to organized crime in Eastern Europe.

The findings come as Websense, a separate security firm that's based in San Diego, recently estimated that 51 per cent of websites hosting malicious code over the past six months were legitimate destinations that had been hacked, as opposed to sites specifically set up by criminals. Compromised websites can pose a greater risk because they often come with a degree of trust.

Stories reporting security vulnerabilities frequently carry the caveat that an attacker would first need to lure a victim to a malicious website. Poisoning the pages of a legitimate embassy or ecommerce website would be one way to carry that out.

Frequently, the compromised websites launch code that scours a visitor's machine for unpatched vulnerabilities in Windows or in applications such as Apple's QuickTime media player. Such was the case in two recent hacking sprees (here (http://www.theregister.co.uk/2008/01/11/mysterious_web_infection/) and here (http://www.theregister.co.uk/2008/01/08/malicious_website_redirectors/)) that affected hundreds of thousands of sites, including those of mom-and-pop ecommerce companies and the City of Cleveland.

But in the case of the Netherlands Embassy, the attackers simply included text that instructed visitors to download and install the malware. Of course, no self-respecting Reg reader would fall for such a ruse. But sadly, Elzam says, because the instruction is coming from a trusted site, plenty of less savvy users do fall for the ploy. Saps.

"Using social engineering is almost fool proof," he says. "My mother would fall for that because she is really conditioned to click on OK when she's asked to do something like that." ®

© Copyright 2008