Hackers pollute legitimate JavaScript code to spread malware
Posted on 13.02.2013
Most hackers have stopped creating malicious sites long ago and have reverted to hacking legitimate ones and booby-trapping them with exploit kits, malware or malicious scripts. After all, these sites already have their own visitors, and have already been listed and approved by search engines.

According to Sophos researchers, the latest trend among hackers is to inject malicious code into legitimate JavaScript already present on the compromised websites.

"The JavaScript is automatically loaded by the HTML webpages and inherits the reputation of the main site and the legitimate JavaScript," they point out the benefit of this approach, noting that it has the added advantage of the detection occasionally being discarded as a false positive.

They discovered a wide variety of sites across the globe sporting examples of this malicious code, and the best part it is that the code is easily spotted if a knowledgeable human (as opposed to a malware analysis system) manually checks the site's source code. The problem is that not many do.

If you're not your site's web developer, it's important to choose a good hosting provider, the researchers point out. Not only will they keep all the software and the (JavaScript) libraries updated, but they will also fulfill the obligation of checking the site periodically for compromises.


10 practical security tips for DevOps

By working with the DevOps team, you can ensure that the production environment is more predictable, auditable and more secure than before. The key is to integrate your security requirements into the DevOps pipeline.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Mar 31st