2010年2月10日水曜日

Gumbling Gumbling GUMBLAR!!!


So for the past month or two now all I have heard in the Japanese infosec world is GUMBLAR!

(I even overhear people who know nothing about computer security talking about it! It is being talked about as the most devastating and dangerous virus at the moment....)

For those of you who do not know, Gumblar is a piece of malware that infects Windows victims through known Flash and PDF vulnerabilities and once the malware is downloaded and run, it checks for FTP clients such as Filezilla in which is steals the FTP account credentials and then adds malicious JS to all the pages in that person's website they are admining which then attacks more machines through flash/pdf. It also sniffs FTP accounts off the wire and uses in-browser MiTMing of IE to modify google search results. (which is one of the novel things it does that got it famous). I had to research about gumblar as part of my job and didn't find much info. when searching in English except for articles that date back to May 2009 when it peaked. I guess there must have been a lag before getting popular in Japan (as with many things).. so when gumblar lost popularity overseas it came to Japan where it found a new popularity. (as with many bands, not-so-cool guys(like me), etc..)

So people here have been talking about this like people talked about Code Red in the States right after it hit all the IIS servers back in the day. I suppose there is somewhat good reason, as high profile sites such as Yahoo! Japan, Toyota Motors, Mitsubishi, Banks, etc... have started spitting out malicious JS infecting their users after their admins got infected... (If i recall correctly, the small part of Yahoo Japan that got infected (the Horoscope section i think) kept infected for several months before anyone finally realized it) (>_<) !!!
(and why are are these admins using FTP??? and why are they using the systems they use to admin for browsing? with out of date Windows and Flash and Adobe Reader?????)

Boggles my mind...

Anyways, I just wanted to inform the masses of what's hip these days in Japan.

I'm very curious to know if this virus made such an impact in other parts of the world???

0 件のコメント:

コメントを投稿

Please leave me feedback..