'Gumblar' attack explodes across the web

Victims run the risk of the JavaScript attack simply by visiting an infected page

A complex new malware attack is setting infection records and raising serious alarms in the security community.

Known unofficially as 'Gumblar' for one of the attack domains, the malware uses prolific attack methods and carries a dangerous payload.

Researchers say that the attack spreads by compromising web sites and injecting malicious JavaScript code into certain components of the site. A victim runs the risk of the JavaScript attack simply by visiting the infected pages.

Once a site is compromised, the malware alters access credentials and folder permissions to allow an attacker a 'back door' for entry to the site even when the user has changed passwords. The malicious code is also altered in slight ways, preventing administrators from automatically searching out and deleting the scripts.

Because the infection is so hard to get rid of, researchers say that Gumblar has enjoyed far more success than previous malware attacks.

First detected in late March, researchers thought that the attacks had been halted by mid-April when Google delisted the offending sites.

However, a new variant of the attack arose early this month and has been spreading rapidly. Security firm ScanSafe estimates that Gumblar attacks have jumped some 188 per cent over the past week alone, and Sophos credits Gumblar with up to 42 per cent of all malware infections in the past seven days.

"The gross infection rate is exceptional, especially this late in the game," said Mary Landesman, senior security researcher at ScanSafe. "Basically, it has been enjoying a free reign."

The payload is also believed to be highly dangerous. Landesman said that the malware intercepts web traffic such as Google search requests, and redirects it to fraudulent results. This allows the attackers to collect referral fees, and places the user at risk of further infection.

The malware also contains botnet controllers and is programmed to collect all FTP permissions on the infected systems, allowing Gumblar to infect any sites which the user administrates, further fostering the spread to new domains.