Google Poisoning Attack Gumblar Still Causing Problems

I thought this would have been stamped out by now, but sadly it’s still going on. With the advent of cheap web hosting and easy to use CMS systems like WordPress more and more people are managing their own websites (gone are the days of Geocities).

More people with websites means more FTP details to be stolen, and more websites to be spammed up by malware propagators.

With that sentiment, Gumblar is gaining more traction poisoning Google search results.

A Web attack that poisons Google search results is getting worse, according to security researchers.

The attack first relies on compromising normally legitimate website and planting malicious scripts. US CERT reports that stolen FTP credentials are reckoned to be the main technique in play during this stage of the attack but poor configuration settings and vulnerable web applications might also play a part.

Surfers who visit compromised websites are exposed to attacks that rely on well-known PDF and Flash Player vulnerabilities to plant malware onto Windows PCs.

This malware is designed to redirect Google search results as well as to swipe sensitive information from compromised machines, according to early findings from ongoing analysis.

Unsurprisingly the infection vectors are still the same, the recent PDF and Flash exploits. You can bank on the majority of people not installing the updates and still being vulnerable.

As always make sure any networks you manage are updated and the people you know have the latest versions of the software they use to read PDFs and Flash Player.

The SANS Institute’s Internet Storm Centre (ISC) adds that the attack has been around for some time but has intensified over recent days. Initially the malware was served up onto vulnerable Windows clients from the website, which has been offline since Friday. A second domain – – has taken over this key role in the attack, ISC reports.

Web security scanning firm ScanSafe, which was among the first to warn of the rise of the attack, notes that the reference to in more recent attacks has been obfuscated, possibly in an attempt to thwart rudimentary blacklists. “The URI resulting from the injected script might appear as mar”+” instead of just,” writes ScanSafe researcher Mary Landesman.

ScanSafe reported on Monday that Gumblar more than trebled (up 246 per cent) over the preceding week. It describes Gumblar as a botnet of compromised websites in a series of blog postings on the attack, which can be found here. Sophos reckons the Gumblar-related malware appeared in 42 per cent of all the newly infected websites it detected last week.

From the domains being used it seems probably that this attack originated from China, perhaps they are starting to cash in on the malware distribution/spam/info trading scene online.

If they can from behind “The Great Firewall of China“.

It seems like the Gumblar activity has intensified significantly in recent weeks though so do watch out for it. Make sure anyone who has FTP access to any websites you run has a secure system.

Source: The Register

Posted in: Malware, Spammers & Scammers, Web Hacking

, , ,

Latest Posts:

SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.

7 Responses to Google Poisoning Attack Gumblar Still Causing Problems

  1. ANIL KUMAR June 10, 2009 at 8:55 am #


    We are terribly hit by How do we clean it up? Any help will be highly appreciated. We have formatted our systems, added new anti-virus, downloaded and removed all forms of script virus and uploaded, but the problem still persists. We are hit by IPS from china,


  2. Bogwitch June 10, 2009 at 9:42 am #


    Assuming you have no business with China, why not block Chinese IP addresses at your firewall? Better still, restrict FTP access to just those IP addresses that require it.

    As the story suggests, it is weak FTP passwords that are the problem. Are your passwords strong enough or leaking out?

    If you are having serious problems with security, you may find the problem is more widespread than you think and I would recommend employing a professional security consultant to assist you.

  3. neo June 15, 2009 at 6:54 am #

    I thought this would have been stamped out by now, but sadly it

  4. Darknet June 15, 2009 at 9:38 am #

    neo: Upgrading is lame, bring on the h4x0rz!

  5. neo June 15, 2009 at 9:42 am #

    @Darknet: I dint mean to b rough, but the 1st paragraph in this article said

    “I thought this would have been stamped out by now, but sadly it

  6. Darknet June 15, 2009 at 9:49 am #

    Haha nothing, just joking. Means 2.0 is not the real WP version we are running :)

    It’s not hidden though, you can find it in the META tags in the HTML header.

  7. neo June 15, 2009 at 10:00 am #

    yea i did notice it was 2.8 but this is a nice site., i would always recommend my friends., also i hv added u to chat. thanks… hv a gud day