Gumblar: Back With A Vengeance

Earlier this year, the botnet Gumblar made a splash when it infected more than 2,300 Websites, including popular destinations such as Tennis.com, Variety, and Coldwellbanker.com. Now, security researchers say Gumblar is back in strength and is changing its tactics.Essentially, as was reported in May by Tim Wilson in DarkReading, Gumblar was then redirecting infected users to infected Web sites where additional malware would be downloaded to the victim's system, such as a Trojan horse designed to let attackers take control of the consumer's PC. It would also try to capture FTP credentials as a way to infect more Web sites.

From Wilson's story, Rapidly Spreading 'Gumblar' Attack Redirects Users' Web Searches:

One of Gumblar's exploits is to launch a "man-in-the-browser attack," in which the downloaded malware monitors all traffic to and from the browser, Landesman says. From this position, the malware can selectively swap out links in search results, effectively fooling the user into going to an unintended site.

Landesman [senior security researcher at ScanSafe] speculates that Gumblar might be operating as a "botnet for hire," achieving different ends for different "clients." In many cases, the attack seems to be facilitating click fraud, in which the criminal simply redirects Web traffic to a fraud site in order to collect page views and advertising revenue. In other cases, Gumblar is routing users to malicious sites that might load additional malware onto the user's machine.

One of the notable security aspects of Gumblar - which made it difficult to detect by traditional anti-virus and blacklisting techniques - was how its scripts morphed and vapid from Web site to Web site.

Now, according to security researchers at IBM Internet Security Systems, Gumblar is changing its tactics:

In previous versions of Gumblar, the malicious scripts and payload were hosted on a remote server. Iframe code was injected into the compromised website, and it redirected visitors to their rogue server (gumblar.cn). This time around, they are placing the malicious scripts and payload directly on the compromised host, which gives them a decentralized and redundant attack vector, spread across thousands of legitimate websites around the world.

The uploaded scripts are placed carefully to match existing file structures currently on the websites. Heavy obfuscation is used in an attempt to evade some existing security measures.

The result: Gumblar is successfully exploiting vulnerable PDFs, Adobe Flash, and Microsoft Office Web Components.

IBM Internet Security Systems advises corporations to keep their patches and intrusion prevention system signatures up to date. That's good advise for end users, too: make sure your applications are patched and AV and endpoint firewall are running. And, because you can't depend on AV software to fully protect you from these attacks, be very aware of where you're clicking online and any attachments you open.

For my security and technology observations throughout the day, consider following me on Twitter.