Blogs are increasingly being exploited as a means to distribute malicious code and keylogging software. Cyber-criminals are now taking advantage of blog sites that allow users to easily publish their own web pages at no cost. Blogs can be attractive vehicles for hackers for several reasons—blogs offer large amounts of free storage, they do not require any identity authentication to post information, and most blog hosting facilities do not provide antivirus protection for posted files.
In some cases, the culprits create a blog on a legitimate host site, post viral code or keylogging software to the page, and attract traffic to the toxic blog by sending a link through spam email or instant messaging (IM) to a large number of recipients. In other cases, the blog can be used as a storage mechanism that keeps malicious code that can be accessed by a Trojan horse that has already been hidden on the user’s computer.
To date in 2005, Websense® Security Labs™ has discovered hundreds of instances of blogs involved in the storage and delivery of harmful code. For example, on March 23, 2005, Websense Security Labs issued an alert detailing a spoofed email message that attempted to redirect users to a malicious blog that would run a Trojan horse designed to steal banking passwords. In this situation, the user received a message spoofed from a popular messaging service, offering a new version of their IM program. Upon clicking the link, the user was redirected to a blog page, which was hosting a password-stealing keylogger. When predetermined banking websites were accessed, the keylogger (bancos.ju) logged keystrokes and sent them to a third party.
"These aren’t the kind of blog websites that someone would stumble upon and infect their machine accidentally. The success of these attacks relies upon a certain level of social engineering to persuade the individual to click on the link," said Dan Hubbard, senior director of security and technology research for Websense, Inc. "In addition, the blogs are being utilised as the first step of a multi-layered attack that could also involve a spoofed email, Trojan horse, or a keylogger."
As cyber-crooks and hackers continue to find more creative ways to deliver their harmful software, a layered security approach at the internet, network and desktop can protect valuable corporate and employee information. At the internet gateway and desktop, URLs and applications that are identified as being associated with these new scams or those that are infected with keylogging code are categorised and added to the Websense Master Database. Companies can then set policies to block employees from visiting websites, which contain malicious code, providing a proactive layer of security.
Websense Web Security Suite™—Lockdown Edition™ protects organisations from web based threats that are designed to bypass firewalls and antivirus measures. Organisations are able to stop the execution of unauthorised applications such as spyware, keyloggers or viruses on the employee desktop. The software allows only approved applications to run on corporate PCs and servers through its advanced lockdown features. If an employee follows a link to a blog that infects their machine with malicious code, that code would not be able to execute and propagate itself over the network.
|
You are here: hacking technology
> hacker course
> Content
Category: Home
> hacker course