Hackers pollute legitimate JavaScript code to spread malware
Posted on 13.02.2013
Most hackers have stopped creating malicious sites long ago and have reverted to hacking legitimate ones and booby-trapping them with exploit kits, malware or malicious scripts. After all, these sites already have their own visitors, and have already been listed and approved by search engines.

According to Sophos researchers, the latest trend among hackers is to inject malicious code into legitimate JavaScript already present on the compromised websites.

"The JavaScript is automatically loaded by the HTML webpages and inherits the reputation of the main site and the legitimate JavaScript," they point out the benefit of this approach, noting that it has the added advantage of the detection occasionally being discarded as a false positive.

They discovered a wide variety of sites across the globe sporting examples of this malicious code, and the best part it is that the code is easily spotted if a knowledgeable human (as opposed to a malware analysis system) manually checks the site's source code. The problem is that not many do.

If you're not your site's web developer, it's important to choose a good hosting provider, the researchers point out. Not only will they keep all the software and the (JavaScript) libraries updated, but they will also fulfill the obligation of checking the site periodically for compromises.


Pen-testing drone searches for unsecured devices

You're sitting in an office, and you send a print job to the main office printer. You see or hear a drone flying outside your window. Next thing you know, the printer buzzes to life and, after spitting out your print job, it continues to work and presents you with more filled pages than you expected.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Oct 9th