Hackers expand massive IFRAME attack to prime sites

The attacks have spread to a long list of high-profile sites

The massive attacks against hundreds of thousands of Web pages that started earlier this month has spread to some of the Internet's most prominent US sites, including those for USA Today, ABC News, Target and Wal-Mart, researchers said Friday.

Dancho Danchev, the Bulgarian security researcher who first reported the attacks two weeks ago, said that the attacks had spread to a long list of high-profile sites, which have had their search results poisoned with malicious IFRAME code. "The attack's been ongoing for almost a month now," Danchev said in an e-mail.

According to both a follow-up post by Danchev to his own blog, and analysis conducted by researchers at Symantec, hackers have inserted IFRAME code into the saved search results of an unknown number of legitimate sites. People who visit those sites and use the compromised search tool are redirected by the IFRAME code to rogue security software and bogus codec sites, which in turn download malware to the victimized Windows PCs.

The attack code that eventually ends up on users' machines includes newer variants of the Zlob Trojan horse, as well as other backdoors and downloaders.

Danchev identified four IP addresses that he claimed host the malicious files; Symantec backed up his findings. "We have confirmed the attack here at Symantec," said Joji Hamada, a Symantec researcher, in a short post to the company's security blog.

The IP addresses Danchev fingered include:

The four addresses are associated with servers located in the US, Panama and Germany, Danchev said.

"The main IPs behind the IFRAMES are still active, new pieces of malware and rogue software [are] introduced, hosting for which is still courtesy of the Russian Business Network, and we're definitely going to see many other sites with high page-ranks targeted by a single massive SEO [search engine optimization] poisoning in a combination with IFRAME injections," said Danchev in his blog post.

When Danchev raised the alarm earlier this month, the compromised sites included a mix of both legitimate and questionable URLs, including those for the North Carolina State University library and the US government's Medicare program, as well as BitTorrent sites serving up pirated software.

"In the past, we've seen many low-profile sites being targeted with the IFRAME attack," Hamada added, "but this time the list of hacked sites include many high-profile sites as well. This is very disturbing, because many big corporations often go out of their way to protect themselves, yet [they] get hit like this."

Danchev identified a long list of affected sites, including USAToday.com, ABCNews.com, News.com, Target.com, Walmart.com, Bloomingdales.com, WebShots.com, Sears.com, Forbes.com, Circuitcity.com, Epinions.com, JCPenney.com, and those for the University of Vermont and Boise State University.

Symantec recommended that network administrators block both incoming and outgoing traffic to the four IP addresses, and Hamada urged IT staffs to take another sweep through their servers. "It might a good time for everyone to audit their servers again," he said.

Users can protect themselves by rejecting any request to download an unexpected codec or security program.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Show Comments

Brand Post

PC World Evaluation Team Review - MSI GT75 TITAN

"I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it."

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?