Viruses/Worms News

Gumblar malware poisoning Google searches, exploiting websites

Friday, May 15, 2009

Attacks from a virus called Gumblar have increased dramatically in the first weeks of May as it spreads rapidly to infect new PCs. Malware uploaded to PCs by the attacks forcibly redirects Google search page results to malicious websites, which perpetuate the virus, security researchers said.

Gumblar exploits bugs in Adobe Flash and PDF to install malware which steals FTP credentials and creates a back door and take control of the infected computer. Once the PC has been hijacked, the malware launches a man-in-the-middle attack to poison Google search results in Internet Explorer, researchers said.

The stolen FTP credentials are used to compromise any websites owned or operated by the victim, according to eWEEK. More victims are infected by encountering a compromised site, which so far totals more than 1,500 sites including Tennis.com, Variety.com and Coldwellbanker.com, eWEEK reported.

Google began delisting the malicious sites appearing in search engine results when the attacks were first spotted in March, but the hackers have responded by using different IP addresses.

Gumblar attacks, named for the domain gumblar.cn involved in the attacks, are sometimes accompanied by malicious iframes that load exploits and malware from domains hosted in Latvia. The gumblar.cn domain has a Moscow IP, researchers said.