Information Security News: French Embassy Web site for Libya said to be serving up malware

[InfoSec News <alerts () infosecnews org>]

http://www.networkworld.com/news/2007/121307-libya-site-malware.html

By Ellen Messmer
Network World
12/13/07

The French Embassy Web site for Libya has been compromised and is 
serving up malware to visitors, according to McAfee.

McAfee researcher Francois Paget discovered Thursday and the company 
says it has reported its findings to the French government. The site has 
been attacked using an iFrame exploit that inserts an invisible frame in 
the page in order to re-direct some Web browser connections to another 
location, which serves up a "downloader," code that attempts to reside 
on the victim machine. If the downloader is successful, the attacker can 
then remotely attempt to download other malware, "typically a bot or a 
password-stealing Trojan," says Dave Marcus, McAfee security researcher 
and communications manager.

Marcus says Paget, a researcher with tools to scan scripts and 
investigate code behavior, happened by chance to be looking at the 
French Embassy Web site for Libya and discovered the attack code on it. 
The incident is similar to discoveries made by security researchers of 
other compromised Web sites spewing attack code, including that of the 
Bank of India and the MySpace page of Alicia Keys.

McAfee says the attack on the French Web site is being carried out via 
routing through a Hong Kong provider and then to sites in Russia and the 
Ukraine.

All contents copyright 1995-2007 Network World, Inc.


__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/