Several major security companies are warning of a new attack using infected Flash SWF files.
Researchers at Symantec, McAfee and Sans have urged users and administrators to defend against the exploit, which has been found on several Chinese-language sites.
The attack is also being served through as many as 250,000 compromised web pages.
Symantec researchers believe that the pages were hacked through SQL injection scripts, a technique which has been popular in several recent mass-hack incidents.
McAfee researcher Craig Schmugar agreed that the new attack has a familiar feel. "By looking for sites serving these SWF exploits we have found a connection with recent mass hacks," he said.
"Hacked sites reference an external script, just as they have for quite some time. But the external scripts now reference an SWF file."
The compromised pages contain JavaScript code which silently redirects users to the attack site.
Sans researcher Adrien de Beaupre said that at least one of the sites disguises the attack as a .jpg file. The file contains no image, but loads a script which runs the attack and attempts to install a malicious payload.
Symantec said that the attack appears to be occurring on fully patched machines. The company said that it is working with Adobe on the incident.
Users are advised to disable the Flash plug-in on their browsers or limit its use to trusted sites.
Symantec recommends that users install a script-blocking browser plug-in to prevent untrusted sites from running the attack scripts.
Computer scientist urges better education of managers 27 May 2008
Unsuspecting surfers redirected to site laden with malware 13 Mar 2008
Company recommends tools and best practices to prevent attacks 26 Jun 2008
MEPs vote in favour of tougher carbon emission rules, but opposition to wide-reaching programme in some member states is strengthening 07 Oct 2008
Five year scheme will fund university research into green car technologies with good prospects of commercialisation 07 Oct 2008
Renewable Fuels Agency report shows progress is being made to improve biofuel's green credentials, but many high profile firms are still uncertain whether their fuel meets sustainability standards 07 Oct 2008
More news
Philip Mossop, director of Intelligent Waste Management Solutions, explains why the waste industry needs to embrace a whole new business model if it is to help deliver the increase in recycling levels that customers are demanding 07 Oct 2008
On a visit to GE's flagship turbine manufacturing facility in Germany, Andrew Donoghue hears how the engineering giant is betting big on wind energy 06 Oct 2008
In her excoriating account of the US financial crisis, Hazel Henderson argues that only the development of new, more sustainable business and accounting models can prevent a repeat of the current turmoil 02 Oct 2008 More in-depth
Post your comment
Send an email to the Business Green editor at feedback@businessgreen.com
