Infected websites list tops 66,000

SANS INTERNET Storm Center incident handler Mark Hofman writes in its diary that a count of malware infected websites has topped 66,000 and is growing by thousands daily.

The method reminded him of a particularly widespread wibbling infection back in February named for the Superbowl due to its timing, so he investigated a bit. Indeed, he found that the same malicious websites that were used then as redirection targets are again implicated.

The malefactors' mad techniques involve mass defacement, SQL injection, hidden scripts redirecting wibblers' browsers to malicious websites, and downloaded files. The good news, however, is that the executable download seems to be detected by most antivirus software.

The nasty script this time is yl18.net/o.js and the malicious websites include 137wg.com, mmb.net, worldofwarcraftn.com, and Zj5173.com. µ

L'INQ
SANS Diary