Attackers Using Fake Google Analytics Code To Redirect Users To Black Hole Exploit Kit

snoopy · Feb 9, 2012

Wednesday, February 8, 2012
Attackers Using Fake Google Analytics Code to Redirect Users to Black Hole Exploit Kit

Blackhole Injecting malicious code into the HTML used on legitimate Web sites is a key part of the infection lifecycle for many attack crews, and they often disguise and obfuscate their code to make it more difficult to analyze or so it appears to be legitimate code. The latest instance of this technique has seen attackers employing code that is meant to look like Google Analytics snippets, but instead sends victims off to a remote site that's hosting the Black Hole Exploit Kit. Not the desired result.

Researchers at Websense discovered the ongoing attack recently, and found that the code being used to hide the fake Google Analytics tags is heavily obfuscated, making analysis quite difficult. The malicious code, which is being injected into benign pages on legitimate sites, is designed to look just like actual Google Analytics code and to appear as thought it's referring to common domains. But there are some tell-tale signs that this isn't the case.

The end result of the infection routine is that the victim is passed off to a site that is hosting the Black Hole Exploit Kit, a notoriously nasty piece of software that will try a grab-bag of exploits against the victim's browser until one works. Once that's done, another piece of malware typically is installed on the user's machine, perhaps a keylogger or banker Trojan designed to relieve the victim of her money.
Click to expand...

Full story here: https://threatpost.com/en_us/blogs/attackers-using-fake-google-analytics-code-redirect-users-black-hole-exploit-kit-020812

Be sure to read the comments re the above by “Anonymous”.

Log in or Sign up

Attackers Using Fake Google Analytics Code To Redirect Users To Black Hole Exploit Kit

snoopy Registered Members

Share This Page

Log in or Sign up

Attackers Using Fake Google Analytics Code To Redirect Users To Black Hole Exploit Kit

snoopy Registered Members

Share This Page

Useful Searches