Viruses/Worms News

'Nine-Ball' mass compromise infects 40,000 sites

Thursday, June 18, 2009

Cybercriminals compromised roughly 40,000 legitimate websites in a multi-level redirection attack that takes unsuspecting users to a website called Nine-Ball. Visitors to that site have their PCs infected with malware, web security researchers said.

Similar to recent mass compromise attacks called Beladen and Gumblar, Nine-Ball infects legitimate websites with obfuscated code that redirects site visitors to a series of sites before landing on a final page where a Trojan is downloaded on the user's PC, according to Websense security researchers.

Websense said on its security blog Tuesday that the final landing page, called Nine-Ball, records the visitor's IP address. When visited for the first time, the user is directed to the Nine-Ball site. But when visited again from the same IP address, the user is directed to the benign site of ask.com.

The malicious code attempts to exploit security holes in Acrobat Reader and QuickTime and a malicious file is dropped onto the PC to steal user information.

Stephan Chanette, director of web security research at Websense, said the compromised websites were "sleeping" until Monday, when the attacks went live, according to SCmagazineUS.com.

Chanette said that none of the 40,000 sites infected so far are well-known brands.

"Attackers are going after quantity and not quality," Chanette told SCmagazineUS.com. "If they go after big name websites, they are shut down faster."