http://www.theregister.co.uk/2008/01/23/embassy_sites_serve_malware/ 

By Dan Goodin in San Francisco
The Register
23rd January 2008

Add embassy websites to the growing list of hacked internet destinations 
trying to infect visitor PCs with malware.

Earlier this week, the site for the Netherlands Embassy in Russia was 
caught serving a script that tried to dupe people into installing 
software that made their machines part of a botnet, according to Ofer 
Elzam, director of product management for eSafe, a business unit of 
Aladdin that blocks malicious web content from its customers' networks. 
In November the Ministry of Foreign Affairs of Georgia and Ukraine 
Embassy Web site in Lithuania were found to be launching similar 
attacks, he says.

All three sites had been hacked to include invisible iframes that 
initiated a chain of links that ultimately connected to servers hosting 
malicious code, which was heavily obfuscated to throw off antivirus 
systems. The similarities led eSafe researchers to conclude the attacks 
were carried out by the same group. Elzam speculates the group has ties 
to organized crime in Eastern Europe.

The findings come as Websense, a separate security firm that's based in 
San Diego, recently estimated that 51 per cent of websites hosting 
malicious code over the past six months were legitimate destinations 
that had been hacked, as opposed to sites specifically set up by 
criminals. Compromised websites can pose a greater risk because they 
often come with a degree of trust.

Stories reporting security vulnerabilities frequently carry the caveat 
that an attacker would first need to lure a victim to a malicious 
website. Poisoning the pages of a legitimate embassy or ecommerce 
website would be one way to carry that out.

Frequently, the compromised websites launch code that scours a visitor's 
machine for unpatched vulnerabilities in Windows or in applications such 
as Apple's QuickTime media player. Such was the case in two recent 
hacking sprees (here [1] and here [2]) that affected hundreds of 
thousands of sites, including those of mom-and-pop ecommerce companies 
and the City of Cleveland.

But in the case of the Netherlands Embassy, the attackers simply 
included text that instructed visitors to download and install the 
malware. Of course, no self-respecting Reg reader would fall for such a 
ruse. But sadly, Elzam says, because the instruction is coming from a 
trusted site, plenty of less savvy users do fall for the ploy. Saps.

"Using social engineering is almost fool proof," he says. "My mother 
would fall for that because she is really conditioned to click on OK 
when she's asked to do something like that."

[1] http://www.theregister.co.uk/2008/01/11/mysterious_web_infection/ 
[2] http://www.theregister.co.uk/2008/01/08/malicious_website_redirectors/ 


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn