WordPress sites served as launching pad for Flashback

Share this article:

The malware responsible for infecting more than 650,000 Mac computers worldwide can thank compromised WordPress sites for its spread, experts say.

The Flashback trojan, first discovered in February, infiltrated Mac OS X platforms through a now-patched Java vulnerability, giving attackers the ability to perform a number of mischievous actions, including stealing data, installing additional malware and intercepting search engine traffic.

To spread the malware, its authors relied on infecting WordPress sites so that when unsuspecting users visited, they were silently redirected to a site that installed Flashback, a tactic known as a drive-by download, Alexander Gostev, head of Kaspersky Lab's global research and analysis team, said Thursday in a blog post.

From February to March, thousands of sites created on the popular publishing platform were poisoned, Gostev said. Researchers believe the sites' webmasters were running vulnerable versions of WordPress.

“Websense put the number of affected sites at 30,000, while other companies say the figure could be as high as 100,000,” Gostev wrote. “Approximately 85 percent of the compromised WordPress sites are located in the United States.”

In late January, Websense began tracking the outbreak on WordPress, one of several that have appeared in recent months and years.

The Kaspersky analysis states that contrary to popular belief, the invulnerability of the Mac OS X is a myth. It is, in fact, no safer than any other operating system. The size of the botnet has dramatically decreased in April as a number of patches released by Apple have cooled the activity.

Although the main infection vectors are the hacked sites, user oversight is ultimately to blame, said Roel Schouwenberg, senior researcher for Kaspersky Lab, in an email to SCMagazine.com on Thursday.

“WordPress is a very popular platform for attackers to target,” he said. “There's not a whole lot WordPress can do if people neglect to update their WordPress or plug-in software.”

It's unclear what the Flashback botnet is being used for. Currently, researchers have not received reports signaling fraudulent activity, Shouwenberg said.

Representatives from Apple and WordPress could not be reached for comment.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

As EMV deadline looms, industry looks to next ATM attack front

As EMV deadline looms, industry looks to next ...

Next year, EMV migration in the U.S. will inevitability change fraudsters' attack methods.

Kevin Mitnick to sell zero-day exploits

Kevin Mitnick's new venture will develop and procure zero-day exploits, then sell them for $100,000 or more.

FBI warns of potential cyber attacks launched by ISIS hacktivists

Following U.S. military airstrikes in the Middle East, the FBI has issued a warning regarding possible cyber threats aimed at U.S. networks and critical infrastructure by hacktivists in support of ISIS.