Malicious sites are hiding themselves behind hacked legitimate sites. Attackers use these legitimate sites to fool the search engines into showing them as the top results for the most popular searches. These sites are then used to redirect visitors to a malicious site on a different domain, displaying a fake antivirus page.
Most of the hack sites are low profile: personal pages, small community sites, etc. But yesterday (03/31), an Argentinian governmental website was showing up in the first 10 results on Yahoo for "who got kicked off dancing with the stars tonight".: hxxp://misioneseduca.gov.ar/rob.php?id=who+got+kicked+off+dancing+with+the+stars+tonigh After clicking on the link, I got redirected to hxxp://p3p0.com/?said=3333&q=WHO+GOT+KICKED+OFF+DANCING+WITH+THE+STARS+TONIGHT
misioneseduca.gov.ar is down today. It appears that it was hacked along with several other PHP websites using Joomla due to a vulnerability in an image gallery plugin.
Not so long ago, hacking a website was the final goal. Attackers would do it for fun, as a political statement, or to steal money or information (login credentials, Social Security Numbers, etc.). Now, a hacked website is a platform to attack users, and not just the ones who frequent the site. Attackers are using Google SEO to widen the range of visitors to the hacked site serving malware.
-- Julien
Blog da Zscaler
Receba as últimas atualizações do blog da Zscaler na sua caixa de entrada
Inscreva-seGovernmental Website Hacked To Spread Malware
Obrigado por ler
Esta postagem foi útil??
Receba as últimas atualizações do blog da Zscaler na sua caixa de entrada
Ao enviar o formulário, você concorda com nossa política de privacidade.