Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/20/2009
02:03 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Gumblar: Back With A Vengeance

Earlier this year, the botnet Gumblar made a splash when it infected more than 2,300 Websites, including popular destinations such as Tennis.com, Variety, and Coldwellbanker.com. Now, security researchers say Gumblar is back in strength and is changing its tactics.

Earlier this year, the botnet Gumblar made a splash when it infected more than 2,300 Websites, including popular destinations such as Tennis.com, Variety, and Coldwellbanker.com. Now, security researchers say Gumblar is back in strength and is changing its tactics.Essentially, as was reported in May by Tim Wilson in DarkReading, Gumblar was then redirecting infected users to infected Web sites where additional malware would be downloaded to the victim's system, such as a Trojan horse designed to let attackers take control of the consumer's PC. It would also try to capture FTP credentials as a way to infect more Web sites.

From Wilson's story, Rapidly Spreading 'Gumblar' Attack Redirects Users' Web Searches:

One of Gumblar's exploits is to launch a "man-in-the-browser attack," in which the downloaded malware monitors all traffic to and from the browser, Landesman says. From this position, the malware can selectively swap out links in search results, effectively fooling the user into going to an unintended site.

Landesman [senior security researcher at ScanSafe] speculates that Gumblar might be operating as a "botnet for hire," achieving different ends for different "clients." In many cases, the attack seems to be facilitating click fraud, in which the criminal simply redirects Web traffic to a fraud site in order to collect page views and advertising revenue. In other cases, Gumblar is routing users to malicious sites that might load additional malware onto the user's machine.

One of the notable security aspects of Gumblar - which made it difficult to detect by traditional anti-virus and blacklisting techniques - was how its scripts morphed and vapid from Web site to Web site.

Now, according to security researchers at IBM Internet Security Systems, Gumblar is changing its tactics:

In previous versions of Gumblar, the malicious scripts and payload were hosted on a remote server. Iframe code was injected into the compromised website, and it redirected visitors to their rogue server (gumblar.cn). This time around, they are placing the malicious scripts and payload directly on the compromised host, which gives them a decentralized and redundant attack vector, spread across thousands of legitimate websites around the world.

The uploaded scripts are placed carefully to match existing file structures currently on the websites. Heavy obfuscation is used in an attempt to evade some existing security measures.

The result: Gumblar is successfully exploiting vulnerable PDFs, Adobe Flash, and Microsoft Office Web Components.

IBM Internet Security Systems advises corporations to keep their patches and intrusion prevention system signatures up to date. That's good advise for end users, too: make sure your applications are patched and AV and endpoint firewall are running. And, because you can't depend on AV software to fully protect you from these attacks, be very aware of where you're clicking online and any attachments you open.

For my security and technology observations throughout the day, consider following me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).