Hackers step up search results attack

Google is attempting to delete infected pages from its cache

A malware attack targeting search engine results is continuing to haunt several high-profile sites.

The attack uses the common cross-site scripting practice of embedding pages with small IFrame tags which redirect the user to a malicious page on a third-party site.

Researchers claimed that the latest attack is unique in that it targets search engine results.

The hackers have compromised search result pages, using search engine optimisation techniques to hijack search results and send users to sites which host malicious downloads.

Among the sites said to be compromised are major news outlets ABC, USAToday and Forbes, and retailers Wal-Mart, Target and Sears.

Security researcher Dancho Danchev said in a blog posting that the attacks have been lingering on the web for more than two weeks, despite efforts by Google to delete infected pages from its cache.

Danchev estimates that up to one million different search queries will lead users to the infected pages.

Administrators can protect against the attack by plugging the input validation vulnerabilities used to seed the malicious code within the pages.

But Danchev does not see the attacks slowing down anytime soon. "We are definitely going to see many other sites with high page ranks targeted by a single search engine results poisoning in combination with IFrame injections," he wrote.