WordPress sites serve as launching pad for Flashback

By Marcos Colon on Apr 20, 2012 8:19 AM
Filed under Security

Correlation between infected sites and prolific trojan.

The malware responsible for infecting more than 650,000 Mac computers worldwide can thank compromised WordPress sites for its spread, experts say.

The Flashback trojan, first discovered in February, infiltrated Mac OS X platforms through a now-patched Java vulnerability, giving attackers the ability to perform a number of mischievous actions, including stealing data, installing additional malware and intercepting search engine traffic.

To spread the malware, its authors relied on infecting WordPress sites so that when unsuspecting users visited, they were silently redirected to a site that installed Flashback, a tactic known as a drive-by download, Alexander Gostev, head of Kaspersky Lab's global research and analysis team, said Thursday in a blog post.

From February to March, thousands of sites created on the popular publishing platform were poisoned, Gostev said. Researchers believe the sites' webmasters were running vulnerable versions of WordPress.

“Websense put the number of affected sites at 30,000, while other companies say the figure could be as high as 100,000,” Gostev wrote. “Approximately 85 percent of the compromised WordPress sites are located in the United States.”

In late January, Websense began tracking the outbreak on WordPress, one of several that have appeared in recent months and years.

The Kaspersky analysis states that contrary to popular belief, the invulnerability of the Mac OS X is a myth. It is, in fact, no safer than any other operating system. The size of the botnet has dramatically decreased in April as a number of patches released by Apple have cooled the activity.

Although the main infection vectors are the hacked sites, user oversight is ultimately to blame, said Roel Schouwenberg, senior researcher for Kaspersky Lab.

“WordPress is a very popular platform for attackers to target,” he said. “There's not a whole lot WordPress can do if people neglect to update their WordPress or plug-in software.”

It's unclear what the Flashback botnet is being used for. Currently, researchers have not received reports signaling fraudulent activity, Shouwenberg said.

Representatives from Apple and WordPress could not be reached for comment.

This article originally appeared at scmagazineus.com

Follow us on Facebook and Twitter

Copyright © SC Magazine, US edition


WordPress sites serve as launching pad for Flashback
Top Stories
Channel's best mingle at 2015 CRN Fast50 networking drinks
[Photos] Who was at the Four Seasons, Sydney on 26 November?
Revealed: The 2015 CRN Fast50!
Meet the fastest-growing IT service providers in Australia.
Sign up to receive CRN email bulletins
Was your most important vendor the same in 2015 as in 2014?

Latest Comments
CRN Magazine

Issue: 343 | October 2015

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.