Hackers Attack 40,000 Sites Overall

VIP LOUNGE

CLOUD LOGIN

You are here: News > News > Hackers Attack 40,000 Sites Overall

» IT Security NEWS

» 03 June 2009

Hackers Attack 40,000 Sites Overall

According to the security experts from Websense, a total of more than 40,000 websites in the entire world have fallen victim to a piece of harmful code found in a fake website that covertly attempts to install malware onto the computers of people who visit the rogue page. This could prove to be one of the biggest, if not the biggest, malware plague in the history of the worldwide web.

This global hack phenomenon has been labeled Beladen because beladen.net is one of the web domains hackers use to launch a throng of exploits that pinpoint system vulnerabilities found in Firefox and Internet Explorer browsers as well as applications like Apple's QuickTime. Once they found their target, they insert intentionally incomprehensible JavaScript code that's been altered slightly each time, making it impossible to recognize affected sites through search engines.

The infected websites are mostly operated by government agencies and smaller business that typically cannot afford a sophisticated level of Internet security. Stephen Chenette, manager for security research at Websense, confessed that he and his fellow Websense researchers have so far been incapable of spotting the common element that the hackers are using to victimize websites. As of now, they can only speculate that the sites were breached by covertly installing key-logging software onto the computers of the people who maintain the sites.

Chenette elaborated that assumptions and conjectures are all Websense has because there has been no shared injection between the 40,000 sites. The only other possible reason why those tens of thousands of websites were hacked is that "the website owners have basically had their FTP credentials or account credentials compromised."

However, it remains a mystery just how many end users are currently being disturbed and involved in this virtual catastrophe. ScanSafe researcher Mary Landesman informed that 0.03% of the ScanSafe customer base have attempted to visit a site compromised by Beladen in the entirety of last month. That's a miniscule number compared to the whopping 37% of its patrons that are trying to browse sites hit by Gumblar, another mass infection bug. Gumblar follows the same modus operandi that Beladen has, installing malware onto the machines of people visiting affected websites.

In conclusion, it's abundantly clear that the hackers responsible for Beladen have taken meticulous steps to assure its stealth and concealment. Aside from the obfuscated JavaScript, the authors of this hack have also covered their tracks by shoving targets through a sequence of go-between servers before ultimately ending up them at the Beladen website.