20 May 2009 | 5,649 views

Google Poisoning Attack Gumblar Still Causing Problems

Cybertroopers storming your ship?

I thought this would have been stamped out by now, but sadly it’s still going on. With the advent of cheap web hosting and easy to use CMS systems like WordPress more and more people are managing their own websites (gone are the days of Geocities).

More people with websites means more FTP details to be stolen, and more websites to be spammed up by malware propagators.

With that sentiment, Gumblar is gaining more traction poisoning Google search results.

A Web attack that poisons Google search results is getting worse, according to security researchers.

The attack first relies on compromising normally legitimate website and planting malicious scripts. US CERT reports that stolen FTP credentials are reckoned to be the main technique in play during this stage of the attack but poor configuration settings and vulnerable web applications might also play a part.

Surfers who visit compromised websites are exposed to attacks that rely on well-known PDF and Flash Player vulnerabilities to plant malware onto Windows PCs.

This malware is designed to redirect Google search results as well as to swipe sensitive information from compromised machines, according to early findings from ongoing analysis.

Unsurprisingly the infection vectors are still the same, the recent PDF and Flash exploits. You can bank on the majority of people not installing the updates and still being vulnerable.

As always make sure any networks you manage are updated and the people you know have the latest versions of the software they use to read PDFs and Flash Player.

The SANS Institute’s Internet Storm Centre (ISC) adds that the attack has been around for some time but has intensified over recent days. Initially the malware was served up onto vulnerable Windows clients from the website gumblar.cn, which has been offline since Friday. A second domain – martuz.cn – has taken over this key role in the attack, ISC reports.

Web security scanning firm ScanSafe, which was among the first to warn of the rise of the attack, notes that the reference to martuz.cn in more recent attacks has been obfuscated, possibly in an attempt to thwart rudimentary blacklists. “The URI resulting from the injected script might appear as mar”+”tuz.cn instead of just martuz.cn,” writes ScanSafe researcher Mary Landesman.

ScanSafe reported on Monday that Gumblar more than trebled (up 246 per cent) over the preceding week. It describes Gumblar as a botnet of compromised websites in a series of blog postings on the attack, which can be found here. Sophos reckons the Gumblar-related malware appeared in 42 per cent of all the newly infected websites it detected last week.

From the domains being used it seems probably that this attack originated from China, perhaps they are starting to cash in on the malware distribution/spam/info trading scene online.

If they can from behind “The Great Firewall of China“.

It seems like the Gumblar activity has intensified significantly in recent weeks though so do watch out for it. Make sure anyone who has FTP access to any websites you run has a secure system.

Source: The Register


Recent in Malware:
- DAMM – Differential Analysis of Malware in Memory
- FBI Recommends Crypto Ransomware Victims Just Pay
- Fitbit Vulnerability Means Your Tracker Could Spread Malware

Related Posts:
- Massive Malware Outbreak Infects 30,000 Websites
- ARPwner – ARP & DNS Poisoning Attack Tool
- HD Moore’s Company BreakingPoint Suffers DNS Attack

Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,429 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,540 views
- US considers banning DRM rootkits – Sony BMG - 44,959 views

Low-cost VPS Hosting

7 Responses to “Google Poisoning Attack Gumblar Still Causing Problems”

  1. ANIL KUMAR 10 June 2009 at 8:55 am Permalink


    We are terribly hit by gumblar.cn. How do we clean it up? Any help will be highly appreciated. We have formatted our systems, added new anti-virus, downloaded and removed all forms of script virus and uploaded, but the problem still persists. We are hit by IPS from china,


  2. Bogwitch 10 June 2009 at 9:42 am Permalink


    Assuming you have no business with China, why not block Chinese IP addresses at your firewall? Better still, restrict FTP access to just those IP addresses that require it.

    As the story suggests, it is weak FTP passwords that are the problem. Are your passwords strong enough or leaking out?

    If you are having serious problems with security, you may find the problem is more widespread than you think and I would recommend employing a professional security consultant to assist you.

  3. neo 15 June 2009 at 6:54 am Permalink

    I thought this would have been stamped out by now, but sadly it

  4. Darknet 15 June 2009 at 9:38 am Permalink

    neo: Upgrading is lame, bring on the h4x0rz!

  5. neo 15 June 2009 at 9:42 am Permalink

    @Darknet: I dint mean to b rough, but the 1st paragraph in this article said

    “I thought this would have been stamped out by now, but sadly it

  6. Darknet 15 June 2009 at 9:49 am Permalink

    Haha nothing, just joking. Means 2.0 is not the real WP version we are running :)

    It’s not hidden though, you can find it in the META tags in the HTML header.

  7. neo 15 June 2009 at 10:00 am Permalink

    yea i did notice it was 2.8 but this is a nice site., i would always recommend my friends., also i hv added u to chat. thanks… hv a gud day