For all those people who say browser vulnerabilities are no big deal, this iFrame can be used to steal information or host malware. This is a great example of why it is in fact a big deal if a website can exploit your browser. 90,000 sites on the web are hosting this site which is malicious...
Pwn2Own accepts browser exploits because they know that the web is a prolific attack vector and widespread XSS, SQL injection, and PHP worms can lead to high rates of hosted malware and thus high infection rates through browser based exploits.
This is a huge deal and I wish it the analysis in this article pointed out what the stakes are for XSS attacks and received more coverage. 90,000 sites + 1 IE, Safari, or Firefox exploit means potentially millions infected.
Security researchers from Armorize have intercepted a currently live mass iFrame injection attack, affecting over 90,000 Web pages.
Once the users visits an affected page, a number of javascript redirectors lead the user to a client-side exploits serving page.
How did the attack take place? Malicious attackers are either abusing input validation flaws within the vulnerable sites, or have been harvesting botnets for stolen FTP credentials in order to embed the pages with the malicious iFrame.
Go through related posts:
- More High Profile Sites IFRAME Injected
- ZDNet Asia and TorrentReactor IFRAME-ed
- Massive IFRAME SEO Poisoning Attack Continuing
- More CNET Sites Under IFRAME Attack
- Wired.com and History.com Getting RBN-ed
- Embedding Malicious IFRAMEs Through Stolen FTP Accounts
- Embedding Malicious IFRAMEs Through Stolen FTP Accounts - Part Two
- Injecting IFRAMEs by Abusing Input Validation
The iFrame domain willysy(dot)com is currently flagged as malicious.
