Wednesday, July 22, 2009 9:11 AM
cmosby
ColdFusion Spurs Another Mass Compromise – TrendLabs Malware Blogs
Jul8
ColdFusion Spurs Another Mass Compromise
8:35 pm (UTC-7) | by Jonathan Leopando (Technical Communications)
June saw more than its fair share of mass-compromised websites—with one wave early in the month and Nine Ball hitting later on in the month. One would hope that July would be different, but it was not to be.
Last week saw another wave of compromised websites that had one thing in common—they were all running ColdFusion on their servers. ColdFusion is a popular platform for developing Internet applications. It is currently owned by Adobe. Users blamed the effectivity of this attack on older versions of certain ColdFusion applications that sported security vulnerabilities and allowed malicious users to upload code to run on already-compromised servers. Cybercriminals then modified the compromised sites to include iframe links to malicious websites.
As with previous attacks, these compromised websites download a malicious file Trend Micro detects as TROJ_DROPPER.PXQ onto the affected system. This file then drops and runs another file detected as TROJ_DLOADR.XNI, which in turn, downloads and executes files detected as TROJ_WIMPIXO.BG and TROJ_SOMEX.C.
Just like the other attacks, the end goal of this particular wave is to steal user information. However, the files in question are already detected by Smart Protection Network.
This entry was posted on Wednesday, July 8th, 2009 at 8:35 pm and is filed under Exploits, Security . You can leave a response, or trackback from your own site.
Filed under: Security and Anti-Virus, Internet Applications, Spam\Phishing, Enterprise Applications, Software Vulnerabilites