A mysterious virus has been attacking hundred of sites, most UK-based. Among them, Directline-holidays, a company for the customers with a small budget but eager to have a vacation.The computers of the people using the site are infected with a Trojan which extracts information and uses for its purpose.
The problem is that it leaves no tracks and so is complicated to be discovered.Mary Landesman, a researcher at the security firm ScanSafe reported that, trying to solve the problem from one company, they reconstructed the server completely, but “an hour later the problem came back”.
According to ScanSafe there are 200 affected websites, however, Finjan and Secure Works say that they are 10,000.These sites covers areas like traveling, property and motoring and they draw many visitors because they are operative in search results.
Because Directline-holidays is offering “cheap holidays” it attracts many visitors, almost 80,000 daily. When someone from the site’s technical staff detected a problem at the server, it proved to be version of a virus "that most security software didn't recognize" (quote of a company’s spokesman).
Don Jackson, a security researcher at SecureWorks stated that since evasion technique complicates things, it will have a long existence.Even more, the specialists declare that it doesn’t present typical "attack patterns" of well-known Russian or Chinese groups.Its dynamic manifestation makes the virus undetectable for numerous anti-virus programs.
In such cases the procedure is supposed to be simple: on an affected website the hackers will lead the visitor into a trap. Following the trail, the specialists can locate the sites and notify the owners.In our situation, the harmful files remain undetectable until a person visits the page.
Mikko Hypponen, chief research officer at security company F-Secure, told that the Trojan is called 'on-the-fly'. Only Windows users are affected by the virus.Mr. Hypponen advises to regularly update the virus protection and to download only the latest version of browsers and other applications.
|
