Extract from The Register
Security site vitalsecurity.org reports that a group of hackers - perhaps a criminal gang - is hacking web servers across the net and installing root kits that dynamically inject code into the pages served from the compromised web servers.
The injected code effectively serves as a "front door" to a series of compromised hosts controlled by cyber criminals. These rogue hosts are running exploit code that takes advantage of the IFRAME vulnerability in Internet Explorer exploited by the recent Bofra worm.
This is similar to Download.Ject, only this time it works on Apache servers rather than Windows," explained Christopher Boyd of vitalsecurity. "Using IFRAME, a number of sites install anything up to 8MB worth of exploits on a user's machine - viruses, Trojans, scripts, malware packages - you name it, you'll end up with it."
Software installed on victims' PCs varies from porn diallers to spyware and adware packages. According to Finnish anti-virus firm F-Secure, the activity reported by vitalsecurity began on Friday night (19 November) and remains ongoing. But so far victims seem to be thin on the ground.
"The interesting part here is the usage of the new IFRAME vulnerability, for which Microsoft still has no patch out. We urge users either to go with Windows XP with SP2 or to upgrade their Internet Explorer to any other browser," said Mikko Hyppoenen, director of anti-virus research at F-Secure. "We haven't received huge amounts of reports from people who would have been actually hit by it (many wouldn't notice it, of course). Traces seem to end with updates.virtumonde.com [a Brazilian website]."
The attack mechanism is similar to that first seen during the Download.Ject security flap in June, when sites running unpatched versions IIS 5 were infected with malicious JavaScript code. Websites running the latest versions of Microsoft IIS were unaffected. Users visiting a website contaminated with Download.Ject with unpatched versions of IE activated a script that downloaded a Trojan horse (called Berbew) from a website in Russia.