Tuesday, Jun 9, 2009    Text size: 

In a recent letter to its clients, adult web hosting provider MojoHost said that it had caught attacks at an early stage, before most of its customers encountered this problem.

"To give this scenario perspective, in the last week we have identified [several] clients where in the final analysis it was determined this exploit of client side software has been the culprit," stated a MojoHost representative.

The United States Computer Emergency Readiness Team is monitoring the situation and according to the US-CERT website, the attack is a drive-by-download exploit with multiple stages and is being referred to as "Gumblar."

"The first stage of this exploit attempts to compromise legitimate websites by injecting malicious code into them," stated a Team report. "Reports indicate that these website infections occur primarily through stolen FTP credentials but may also be compromised through poor configuration settings, vulnerable web applications, etc."

The exploit's second stage occurs when users visit a Gumblar-infected website.

"Users who visit these compromised websites and have not applied updates for known [Adobe] PDF and Flash Player vulnerabilities may become infected with malware," the Team report continued. "This malware may be used by attackers to monitor network traffic and obtain sensitive information, including FTP and login credentials that can be used to conduct further exploits."

"If you are not running the most recently patched versions of Adobe Acrobat and Adobe Flash Player, you are at risk for compromising your websites," the MojoHost rep said. "This poses a significant security risk to your server and websites, leading to attackers using client FTP credentials to deface websites and insert malicious code which can exploit things further."

The Team report also states that Gumblar redirects Google search results for infected users.

As for what to do about the situation, US-CERT "encourages users and administrators to apply software updates in a timely manner and use up-to-date antivirus software to help mitigate the risks."

The agency will provide additional information as it becomes available.

"This unexpected exploit of everyday software is a lesson to everybody about just how fragile things truly can be," the MojoHost rep concluded; recommending that webmasters of affected sites contact their hosting support team to help mitigate any damage and to issue a new FTP password.

Readers are urged to update their software by visiting the publisher's websites: get.adobe.com/flashplayer/ and get.adobe.com/reader/.