Mass attack infects hundred of thousands of reputable sites

A new attack has infected hundreds of thousands of web sites, including a United Nations site and some U.K. government sites. Browsing to these normally safe websites will cause users to unknowingly load a file that automatically attempts to serve up a concoction of eight different exploits designed to gain access to their computer and install information-stealing malware. 

This mass attack appears to be from the same group of individuals behind a similar attack a few weeks ago that compromised thousands of internet domains, including U.S. news and travel websites, according to Websense Security Labs. The attackers have switched over to a new domain as their hub for hosting the malicious payload in this attack. The exploits target Microsoft applications, specifically browsers not patched against the VML exploit, as well as other applications

“The problem with this attack is that it affects reputable sites,” Dan Hubbard, vice president of security research at Websense Security Labs told SCMagazineUS.com on Wednesday. He added, “If you have the latest fully patched version of Windows, there is little danger. The problem is that many users do not always run the latest patch updates.”

These attacks are among a growing number of recent attacks that take advantage of the flaws in traditional security solutions, solutions that rely on signatures and web reputation to protect customers. By infecting hundreds of thousands of well-trafficked, well-known websites simultaneously, the attackers only need a window of a few hours to harvest a large number of potential victims. Web users and organizations without real-time protection may be vulnerable.