From Wilson's story, Rapidly Spreading 'Gumblar' Attack Redirects Users' Web Searches:
One of Gumblar's exploits is to launch a "man-in-the-browser attack," in which the downloaded malware monitors all traffic to and from the browser, Landesman says. From this position, the malware can selectively swap out links in search results, effectively fooling the user into going to an unintended site.
Landesman [senior security researcher at ScanSafe] speculates that Gumblar might be operating as a "botnet for hire," achieving different ends for different "clients." In many cases, the attack seems to be facilitating click fraud, in which the criminal simply redirects Web traffic to a fraud site in order to collect page views and advertising revenue. In other cases, Gumblar is routing users to malicious sites that might load additional malware onto the user's machine.
One of the notable security aspects of Gumblar - which made it difficult to detect by traditional anti-virus and blacklisting techniques - was how its scripts morphed and vapid from Web site to Web site.
Now, according to security researchers at IBM Internet Security Systems, Gumblar is changing its tactics:
In previous versions of Gumblar, the malicious scripts and payload were hosted on a remote server. Iframe code was injected into the compromised website, and it redirected visitors to their rogue server (gumblar.cn). This time around, they are placing the malicious scripts and payload directly on the compromised host, which gives them a decentralized and redundant attack vector, spread across thousands of legitimate websites around the world.
The uploaded scripts are placed carefully to match existing file structures currently on the websites. Heavy obfuscation is used in an attempt to evade some existing security measures.
The result: Gumblar is successfully exploiting vulnerable PDFs, Adobe Flash, and Microsoft Office Web Components.
IBM Internet Security Systems advises corporations to keep their patches and intrusion prevention system signatures up to date. That's good advise for end users, too: make sure your applications are patched and AV and endpoint firewall are running. And, because you can't depend on AV software to fully protect you from these attacks, be very aware of where you're clicking online and any attachments you open.
For my security and technology observations throughout the day, consider following me on Twitter.