Huge Web hack attack infects 500,000 pages

Sites may have been compromised through a "security issue" in Microsoft's Web server software

Microsoft also contested Panda's claim that it had reported a problem. "Microsoft is currently aware of and is reviewing reports regarding public claims of attacks on IIS Web servers," said Bill Sisk, a communications manager who works in the Microsoft Security Response Center. "While we have not been contacted directly regarding these reports, we will continue to monitor all reports either publically shared or responsibly disclosed and investigate once sufficient details are provided."

Although it may not be clear how attackers are compromising such large numbers of Web sites, what happens after a site is infected is well-understood, researchers have said. When a visitor reaches one of the hacked sites, malicious JavaScript loads an IFRAME from a malware-hosting server; the IFRAME redirects the browser to a different page, also hosted on the hacker's server.

Next, a multiple-strike attack kit is downloaded to the visitor's PC. The kit tries eight different exploits, and if it finds one that works, hijacks the system.

These kinds of attacks, said Sherstobitoff, essentially make the idea of a "trusted site" moot. "You used to know that if you walked down the dark streets of the Web, you would be infected. Today, you really can't tell what the dark streets are."

The hacker strategy, of course, is to leverage that uncertainty. "This is getting really bad," Sherstobitoff said.

It's so bad, in fact, that while security companies urged Web site administrators to check their server logs for evidence of a compromise, and told corporate security staffs to block several malware-hosting sites at their companies' perimeters, they didn't have much useful advice for end-users.

"Users should be extremely wary when visiting sites, even those typically trusted," was about all Symantec could come up with in an alert to customers of its DeepSight threat notification service.

Disabling JavaScript can also protect against such attacks, Symantec added. Users, however, are often reluctant to switch off JavaScript because without it, many sites are crippled or won't display properly.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?