An upcoming major threat - Gumblar Virus

[Steve123]

Most of us have never heard of the Gumblar virus, but it’s rapidly becoming a major threat to PC users.A worm that’s targeting Google users the most mainstream online group of all, is becoming increasingly virulent and is now seen by some experts as the biggest Internet security threat out there.It works by hitting computers via vulnerabilities in some versions of PDF reader and Flash player software. Once PC has been infected, the virus redirects Google search results to sites that load more malware on the PC or let criminals steal login details for banking, social networking and websites.

Gumblar, which is also known as JSRedir-R, is latching onto its victims through security flaws.Like Conflickr, it is being distributed through drive-by downloads; it’s spreading through Flash movies and PDF files that have been compromised and infiltrating computers without their owners having any chance of knowing about it. Although Gumblar has been around for some time, it’s recently mutated, changing its style of attack, taking malicious code from a web page based in China, and developing new techniques to avoid detection, according to the Guardian.After attacking, it starts diverting everyone’s favourite search engine so that its results point either to pages where more malware can shovelled onto the unwitting victim’s machine or to phishing websites, where account details for banks or social networking sites could be stolen.

Sophos,Anti-virus maker stated,"it’s currently behind 42 per cent of all cases of malicious code that they’re finding on websites - and there are reports that it’s infecting a new webpage once every four and a half seconds. Making matters worse, the writers of the virus have recently changed their tactics to make their code much harder to isolate."Mary Landesman, a senior security researcher with ScanSafe, told the newspaper:"The Gumblar attacks have morphed again. What we're really looking at here can only be described as a botnet of compromised websites. And a growing one at that."a stolen car - so that they could be re-listed behind the Mountain View firm’s back. Most recently, they’ve optimised their monster so that it sidesteps the security features of its browser, Chrome.

[Faint]

In addition Mary Landesman says,"“Because of the complexity of the Gumblar compromises, detection via traditional methods, such as signature detection and blacklisting, are ineffective,Gumblar’s sophistication and incredible growth rate should serve as a wake up call to the IT community. As cybercrime evolves in sophistication, so must our protection against it".The new Gumblar can effectively target Google Chrome users by skillfully avoid its blacklisted sites.

[Big Fish]

There is the warning from the experts that the Gumblar virus is mutating and quickly becoming a massive security threat.The cybercriminals behind Gumblar responded by changing the IP addresses of those websites - a bit like having a re-spray job on a stolen car - so that they could be re-listed behind the Mountain View firm’s back. Now every fight goes up to Google.