It seems like malware pushers have found another avenue to delivery their payloads, Embassy websites. Which makes sense as they are probably not maintained well nor updated often meaning the chance they are easily compromised is quite high.

Plus a lot probably use off the shelf CMS software, which when not updated is a playground for hackers.

Add embassy websites to the growing list of hacked internet destinations trying to infect visitor PCs with malware.

Earlier this week, the site for the Netherlands Embassy in Russia was caught serving a script that tried to dupe people into installing software that made their machines part of a botnet, according to Ofer Elzam, director of product management for eSafe, a business unit of Aladdin that blocks malicious web content from its customers’ networks. In November the Ministry of Foreign Affairs of Georgia and Ukraine Embassy Web site in Lithuania were found to be launching similar attacks, he says.

Again it just goes to show that a lot of malicious attacks are based around human elements, in this case trust. People will naturally trust an Embassy website, so if you embed it with a message to download some kind of protective software…a lot of people will do it.

Frequently, the compromised websites launch code that scours a visitor’s machine for unpatched vulnerabilities in Windows or in applications such as Apple’s QuickTime media player. Such was the case in two recent hacking sprees that affected hundreds of thousands of sites, including those of mom-and-pop ecommerce companies and the City of Cleveland.

But in the case of the Netherlands Embassy, the attackers simply included text that instructed visitors to download and install the malware. Of course, no self-respecting Reg reader would fall for such a ruse. But sadly, Elzam says, because the instruction is coming from a trusted site, plenty of less savvy users do fall for the ploy. Saps.

Again we can just educate and spread the news, tell people not to trust any web sites if possible, use md5 hashes, use trusted sources, scan for the viruses etc..

Trust no one! (Except me of course *evil laugh*).

Source: The Register