Gumblar compromise growth continues

Dominant web threat infecting still more vulnerable sites.

A major web compromise, estimated by some to represent over 40% of infected web pages last week, has continued growing in size and prevalence at an alarming rate.

The threat, commonly dubbed ‘Gumblar’ after a domain used by early versions, but also known as ‘JS/Redir’, is thought to inject itself into websites using stolen ftp credentials to hosting servers, and uses the infected pages to serve malware which may seek out further ftp login data. It may also doctor

Google

search results to redirect more victims to compromised hosts, which attempt to infect via PDF and Flash exploits.

The threat’s sharp growth in size was highlighted last week by researchers at


Sophos


and at


ScanSafe


, and the spurt seems to have continued with ever higher figures reported by a variety of sources. Mary Landesman at

ScanSafe

has kept up a running commentary on the spread of the threat on the STAT blog

here

, with more details on the threat itself at

Unmask Parasites


here

and reports from

US-Cert


here

and

SANS


here

.

Posted on 20 May 2009 by

Virus Bulletin