Report: Over 10,000 websites infected by keylogging Trojan

A worrying development in criminally inspired malware, or 'crimeware' for short, emerged last year with a bang -- then it seemed to fade from view. It involved malware that was installed on legitimate websites and passed onto unsuspecting web users, infecting an untold number of web surfers who simply visited the sites. They included those run by The Economist, Major League Baseball and Canada.com, to name a few. The menace is back, net security specialists are reporting, and it's much worse than the first time around.

According to net security specialists at Finjan, there are now 10,000 legitimate websites that have been infected by this nasty Trojan, which it calls 'random jstoolkit'. (For more details on this piece of crimeware, check out Finjan's latest web security report here). Once installed on a victim's computer, it begins intercepting user data -- documents, passwords, PINs, surfing habitats, they are all targeted by the Trojan.
What makes this particular threat so unnerving is that it continuously changes form, making it nearly impossible for antivirus software to pick up. By fooling the antivirus software so effectively, it has managed to spread quickly. Finjan estimates that it is infecting 30,000 web pages per day, and that by the end of the year, the number of infected domains topped 10,000. In the coming days, Finjan plans to have a list available, naming websites that it says have or had been infected.

Update: The silent danger of a clever Trojan

Comments

[ps]

this is a good reason why ant-ivirus software is not enough. a good firewall that stops outgoing trojan-generated traffic is also required.

[Jago]

Does this Trojan only affect Windows Pc's or are Macs affected too?

[Michelle Price]

Given the scale of organised cyber-crime, this figure seems happily low. Perhaps we should be less worried about the number of websites infected, than the highly sophisticated distribution networks that allow crimeware to proliferate so successfully in the first place.

These groups run highly sophisticated business models, which involves creating and selling on malware, the use of outsourced or subcontracted services, and even promotional material. Sites that sell malware components, for example, issue press releases, and employ press relations. So successful is this burgeoning black market that many experts believe the virus writing industry is now more profitable than the AV industry.

Now this is where the real threat lies.

[Caustic Commoner]

Where's Al Gore when we need him?

[Russ Hughes]

Some people seem bent on hurting others, the whyfore normal people can not comprehend. It makes me wonder what people like this were doing before the advent of the computer and the internet. Since Al Gore claims to have invented the internet, maybe we can blame him also for these despicable deeds.

[JoNathan]

I completely agree. A virus scan isn't enough ... you need a firewall active unfortunately a good number of people refuse to use firewalls.

I wonder if NanoScan picks up this virus. NanoScan is a online virus scanning system by Panda Software. I just did a review on it a couple days ago at http://www.EverythingWebRelated.com. I think I am going to write NanoScan and ask them if they have had any reports that their virus scanning system has caught this virus.

[crosvera]

virus? what is that? Sorry. but virus are only for Window's users.

I Use Linux

[Andy]

"virus? what is that? Sorry. but virus are only for Window's users"

Yes......that because nobody cares about Linux or Mac's enough to write one for them

[Justmy2cents]

It's not that nobody cares about linux but it is that windows is so virus friendly.

What does this mean you ask.

It means that basically every windows pc runs software the same way(because one entity handles how the system handles files and the source code of the system software). While almost every linux system handles software different(this includes viruses, malware, and spyware).

Explain further you say.

On a windows computer the system handles all software based what comes after the period(eg. an exe file in windows means that it is an executable file). On the other hand on a linux system you have to tell the system that a file is executable. So no matter what you put after a period the system will not just go ahead and run the file.

Now let us really look at who cares and who does not.

Option A. Windows
You have a company(Microsoft) that has a strangle hold on the home market yet chooses to release software with out proper testing. So now millions of people go out and buy this software thinking that it is safe and well programmed. Only to have a virus and/or other malware installed without there knowledge. What is Microsoft's response to this? You need to spend more money and buy antivirus, firewall, and spyware removal software. So now the consumer is protected right? Wrong, the consumer still needs to make sure that their computer is set to update it self with windows update otherwise it is vulnerably to exploits(programming mistakes that allows someone to gain access and control of one's computer without their knowledge). With the size of most major updates(Service Packs) being so large that broadband is needed to be able to continue internet use while the update is being downloaded. Now Microsoft knows that their software is full of problems so one would think that they would allocate most of the companies resources to fixing the problems. Wrong again! Microsoft devotes most of the companies resources to new software which for the most part has just as many problem if not more as the old software. All the while the consumer has to pay more money for the new software. Now you would expect that your old antivirus, firewall, and spyware removal software to function with the new Microsoft software. Wrong once more! They change the software just enough that other software no longer functions with it. So now you have bought a new computer with new Microsoft software or just made the mistake of buying the new Microsoft software for your old computer only to find out that your other software no longer functions correctly. Now you need to go out and buy new software or like a lot of people have found out you wait for your old software manufacturers to reprogram there software to work with Microsoft's new software all the while you are left unprotected or forced to use Microsoft's option(which is either software programmed by Microsoft, the company you are already having problems with, or by a company that Microsoft has chosen for you).

Option B: Linux
Linux is not after the all mighty dollar. Linux is about writing the best software to do the job. With linux you have companies and people writing software together and alone trying to make the software the best they can. This means that instead of using resources to create new software with the same problems and same features they allocate the resources to fix any problems that arise from current software and to add features instead of starting from scratch every time. This all adds up the consumer getting software that is cost effective and full featured. Now don't get me wrong, linux has some of the same problems as windows. Exploits and the need for a firewall. As for the firewall any and all computers should be protected by a firewall. Exploits that are found are easily fixed with updates. Main stream linux distro's come with package management that allow for updates to be easily installed.

Common Excuses.

1. Linux is not designed for the average computer user.

Completely untrue.

The average computer user uses a computer for internet, email, word processing, and record keeping. All of which are easily installed with any of the main linux distro's package management. The average user also needs a easy to use GUI. Linux has this in either KDE or Gnome. The average user never has to use the command line, as it is designed for the advanced user much in the same way the command line in windows is designed.

2. Linux is not able to run directx for gaming.

Again untrue!

With Wine you can run directx 9 with little to no problems. If linux was moved to main stream consumer computing, companies would write games designed for it. On top of that main stream gaming is now mostly done on gaming consoles(computer's made to run video games with OS's based on linux!) So linux can obviously handle game play.

Solution?

People need to remember that a computer is a tool. Would you give a person any other tool without proper training? If people were properly trained before they used computers we would not see this widespread outbreak of viruses. Its the same as letting people drive with out any training and then being surprised when there are mass major traffic accidents. People may say that this is like comparing apples and oranges because improper driving can cause harm. So how much harm has computer viruses and malware caused? They cause companies to spend large amounts of time and money fixing the problems. Not to mention the loss of personal information which can lead to personal financial losses. Not only are we giving people a tool with out proper training we are giving them a faulty accident prone tool. Until people choose to become educated in the actual cause of the problems we will see a continued rise in viruses and malware.

[Shaun]

"Check back here in the coming days, and we'll have more."

Where is the update?