• Skip to main content
  • Skip to primary sidebar
  • Skip to footer
  • Home
  • About Darknet
  • Hacking Tools
  • Popular Posts
  • Darknet Archives
  • Contact Darknet
    • Advertise
    • Submit a Tool
Darknet – Hacking Tools, Hacker News & Cyber Security

Darknet - Hacking Tools, Hacker News & Cyber Security

Darknet is your best source for the latest hacking tools, hacker news, cyber security best practices, ethical hacking & pen-testing.

Google Poisoning Attack Gumblar Still Causing Problems

May 20, 2009

Views: 5,812

[ad]

I thought this would have been stamped out by now, but sadly it’s still going on. With the advent of cheap web hosting and easy to use CMS systems like WordPress more and more people are managing their own websites (gone are the days of Geocities).

More people with websites means more FTP details to be stolen, and more websites to be spammed up by malware propagators.

With that sentiment, Gumblar is gaining more traction poisoning Google search results.

A Web attack that poisons Google search results is getting worse, according to security researchers.

The attack first relies on compromising normally legitimate website and planting malicious scripts. US CERT reports that stolen FTP credentials are reckoned to be the main technique in play during this stage of the attack but poor configuration settings and vulnerable web applications might also play a part.

Surfers who visit compromised websites are exposed to attacks that rely on well-known PDF and Flash Player vulnerabilities to plant malware onto Windows PCs.

This malware is designed to redirect Google search results as well as to swipe sensitive information from compromised machines, according to early findings from ongoing analysis.

Unsurprisingly the infection vectors are still the same, the recent PDF and Flash exploits. You can bank on the majority of people not installing the updates and still being vulnerable.

As always make sure any networks you manage are updated and the people you know have the latest versions of the software they use to read PDFs and Flash Player.

The SANS Institute’s Internet Storm Centre (ISC) adds that the attack has been around for some time but has intensified over recent days. Initially the malware was served up onto vulnerable Windows clients from the website gumblar.cn, which has been offline since Friday. A second domain – martuz.cn – has taken over this key role in the attack, ISC reports.

Web security scanning firm ScanSafe, which was among the first to warn of the rise of the attack, notes that the reference to martuz.cn in more recent attacks has been obfuscated, possibly in an attempt to thwart rudimentary blacklists. “The URI resulting from the injected script might appear as mar”+”tuz.cn instead of just martuz.cn,” writes ScanSafe researcher Mary Landesman.

ScanSafe reported on Monday that Gumblar more than trebled (up 246 per cent) over the preceding week. It describes Gumblar as a botnet of compromised websites in a series of blog postings on the attack, which can be found here. Sophos reckons the Gumblar-related malware appeared in 42 per cent of all the newly infected websites it detected last week.

From the domains being used it seems probably that this attack originated from China, perhaps they are starting to cash in on the malware distribution/spam/info trading scene online.

If they can from behind “The Great Firewall of China“.

It seems like the Gumblar activity has intensified significantly in recent weeks though so do watch out for it. Make sure anyone who has FTP access to any websites you run has a secure system.

Source: The Register

Share
Tweet
Share
Buffer
WhatsApp
Email
0 Shares

Filed Under: Malware, Spammers & Scammers, Web Hacking Tagged With: google-security, malware, scammers, spammers



Reader Interactions

Comments

  1. ANIL KUMAR says

    June 10, 2009 at 8:55 am

    Hi,

    We are terribly hit by gumblar.cn. How do we clean it up? Any help will be highly appreciated. We have formatted our systems, added new anti-virus, downloaded and removed all forms of script virus and uploaded, but the problem still persists. We are hit by IPS from china 123.125.64.38, 220.181.7.64/67.

    Regards.

  2. Bogwitch says

    June 10, 2009 at 9:42 am

    Anil,

    Assuming you have no business with China, why not block Chinese IP addresses at your firewall? Better still, restrict FTP access to just those IP addresses that require it.

    As the story suggests, it is weak FTP passwords that are the problem. Are your passwords strong enough or leaking out?

    If you are having serious problems with security, you may find the problem is more widespread than you think and I would recommend employing a professional security consultant to assist you.

  3. neo says

    June 15, 2009 at 6:54 am

    I thought this would have been stamped out by now, but sadly it

  4. Darknet says

    June 15, 2009 at 9:38 am

    neo: Upgrading is lame, bring on the h4x0rz!

  5. neo says

    June 15, 2009 at 9:42 am

    @Darknet: I dint mean to b rough, but the 1st paragraph in this article said

    “I thought this would have been stamped out by now, but sadly it

  6. Darknet says

    June 15, 2009 at 9:49 am

    Haha nothing, just joking. Means 2.0 is not the real WP version we are running :)

    It’s not hidden though, you can find it in the META tags in the HTML header.

  7. neo says

    June 15, 2009 at 10:00 am

    yea i did notice it was 2.8 but this is a nice site., i would always recommend my friends., also i hv added u to chat. thanks… hv a gud day

Primary Sidebar

Search Darknet

  • Email
  • Facebook
  • LinkedIn
  • RSS
  • Twitter

Advertise on Darknet

Latest Posts

SUDO_KILLER - Auditing Sudo Configurations for Privilege Escalation Paths

SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Views: 312

sudo is a powerful utility in Unix-like systems that allows permitted users to execute commands with … ...More about SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

Bantam - Advanced PHP Backdoor Management Tool For Post Exploitation

Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

Views: 337

Bantam is a lightweight post-exploitation utility written in C# that includes advanced payload … ...More about Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation

AI-Powered Cybercrime in 2025 - The Dark Web’s New Arms Race

AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Views: 532

In 2025, the dark web isn't just a marketplace for illicit goods—it's a development lab. … ...More about AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race

Upload_Bypass - Bypass Upload Restrictions During Penetration Testing

Upload_Bypass – Bypass Upload Restrictions During Penetration Testing

Views: 522

Upload_Bypass is a command-line tool that automates discovering and exploiting weak file upload … ...More about Upload_Bypass – Bypass Upload Restrictions During Penetration Testing

Shell3r - Powerful Shellcode Obfuscator for Offensive Security

Shell3r – Powerful Shellcode Obfuscator for Offensive Security

Views: 707

If antivirus and EDR vendors are getting smarter, so are the tools that red teamers and penetration … ...More about Shell3r – Powerful Shellcode Obfuscator for Offensive Security

Understanding the Deep Web, Dark Web, and Darknet (2025 Guide)

Understanding the Deep Web, Dark Web, and Darknet (2025 Guide)

Views: 8,981

Introduction: How Much of the Internet Can You See? You're only scratching the surface when you … ...More about Understanding the Deep Web, Dark Web, and Darknet (2025 Guide)

Topics

  • Advertorial (28)
  • Apple (46)
  • Countermeasures (227)
  • Cryptography (82)
  • Database Hacking (89)
  • Events/Cons (7)
  • Exploits/Vulnerabilities (431)
  • Forensics (65)
  • GenAI (3)
  • Hacker Culture (8)
  • Hacking News (229)
  • Hacking Tools (684)
  • Hardware Hacking (82)
  • Legal Issues (179)
  • Linux Hacking (74)
  • Malware (238)
  • Networking Hacking Tools (352)
  • Password Cracking Tools (104)
  • Phishing (41)
  • Privacy (219)
  • Secure Coding (118)
  • Security Software (233)
  • Site News (51)
    • Authors (6)
  • Social Engineering (37)
  • Spammers & Scammers (76)
  • Stupid E-mails (6)
  • Telecomms Hacking (6)
  • UNIX Hacking (6)
  • Virology (6)
  • Web Hacking (384)
  • Windows Hacking (169)
  • Wireless Hacking (45)

Security Blogs

  • Dancho Danchev
  • F-Secure Weblog
  • Google Online Security
  • Graham Cluley
  • Internet Storm Center
  • Krebs on Security
  • Schneier on Security
  • TaoSecurity
  • Troy Hunt

Security Links

  • Exploits Database
  • Linux Security
  • Register – Security
  • SANS
  • Sec Lists
  • US CERT

Footer

Most Viewed Posts

  • Brutus Password Cracker – Download brutus-aet2.zip AET2 (2,292,528)
  • Darknet – Hacking Tools, Hacker News & Cyber Security (2,173,075)
  • Top 15 Security Utilities & Download Hacking Tools (2,096,616)
  • 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) (1,199,677)
  • Password List Download Best Word List – Most Common Passwords (933,468)
  • wwwhack 1.9 – wwwhack19.zip Web Hacking Software Free Download (776,137)
  • Hack Tools/Exploits (673,290)
  • Wep0ff – Wireless WEP Key Cracker Tool (530,148)

Search

Recent Posts

  • SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths May 12, 2025
  • Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation May 9, 2025
  • AI-Powered Cybercrime in 2025 – The Dark Web’s New Arms Race May 7, 2025
  • Upload_Bypass – Bypass Upload Restrictions During Penetration Testing May 5, 2025
  • Shell3r – Powerful Shellcode Obfuscator for Offensive Security May 2, 2025
  • Understanding the Deep Web, Dark Web, and Darknet (2025 Guide) April 30, 2025

Tags

apple botnets computer-security darknet Database Hacking ddos dos exploits fuzzing google hacking-networks hacking-websites hacking-windows hacking tool Information-Security information gathering Legal Issues malware microsoft network-security Network Hacking Password Cracking pen-testing penetration-testing Phishing Privacy Python scammers Security Security Software spam spammers sql-injection trojan trojans virus viruses vulnerabilities web-application-security web-security windows windows-security Windows Hacking worms XSS

Copyright © 1999–2025 Darknet All Rights Reserved · Privacy Policy