nav search
Data Center Software Security Transformation DevOps Business Personal Tech Science Emergent Tech Bootnotes BOFH

back to article
Viral web infection siphons ad dollars from Google

This topic is closed for new posts.

This post has been deleted by a moderator

Anonymous Coward

Wonderful Javascript

Ready to admit that javascript is a mistake for web browsers?

0
0

Some more information

The obfuscated JavaScript on compromised sites (which Sophos intercepts as Troj/JSRedir-R) accounts for about 42% of all of the infected webpages we've seen in the last week.

That's a mightily impressive six times more infections than the tried and trusted malicious Iframe attack of Mal/Iframe-F.

We've published some further information and stats on our site at http://www.sophos.com/blogs/gc/g/2009/05/14/malicious-jsredir-javascript

I'd recommend that surfers check their protection is up-to-date and fighting this one.

0
0
Silver badge

Good thing that

I don't allow JavaScript to run on website, use any Adobe products and only update my site (that doesn't allow JavaScript) by dumping the files into its file share. Nor do I click on any Google advertisements....

Besides, Flaws in Adobe software is old news

0
0
Black Helicopters

is it me or does anyone else see the hand of...

..Kvnt Eurtgruel in this?

0
0
Anonymous Coward

@Christopher Ahrens

Good thing that we both wasted time posting pointless stuff!

0
0
Silver badge

Seriously...

Is anyone still using Adboe Reader??? I thought all the smart people had moved over to Foxit.

0
0
Thumb Up

@Andrew Moore

Not just Foxit, there are a host of alternatives, for Windows and non-Windows alike. KPDF is what comes preinstalled on my OS/distro of choice.

0
0
Jon

htaccess too

I work for a fairly large hosting provider and we're seeing it here too.

Interestingly, we're also seeing a .htaccess being dropped into the root ftp folder which attempts to perform various redirects, set (compromised) custom error docs and calls some perl scripts.

Ammusingly they don't upload the error docs, scripts and their .htaccess is malformed, which simply took the sites offline instead. If the error docs had been correctly uploaded then they'd have spread via the 500 internal server errordoc though.

The reason I mention it is because it's from the same 'straight-in' access from compromised FTP accounts. I cleared out about 15 infections yesterday - of which all logged in first time with the right details.

0
0
This topic is closed for new posts.

The Register - Independent news and views for the tech community. Part of Situation Publishing