French embassy site for Libya 'serving malware'

The French embassy website for Libya has been compromised and is serving up malware to visitors, according to McAfee.

Share

The French embassy website for Libya has been compromised and is serving up malware to visitors, according to McAfee.

McAfee researcher Francois Paget found the site to be compromised last week and McAfee has reported its findings to the French government.

The site has been attacked using an iFrame exploit that inserts an invisible frame in the page in order to re-direct some web browser connections to another location, which serves up a "downloader" – code that attempts to reside on the victim machine.

If the downloader is successful, the attacker can then remotely attempt to download other malware, "typically a bot or a password-stealing Trojan," says Dave Marcus, McAfee security researcher and communications manager.

Marcus said Paget, a researcher with tools to scan scripts and investigate code behaviour, happened by chance to be looking at the French embassy website for Libya and discovered the attack code on it.

The incident is similar to discoveries made by security researchers of other compromised websites spewing attack code, including that of the Bank of India and the MySpace page of Alicia Keys.

McAfee said the attack on the French site is being carried out via routing through a Hong Kong provider and then to sites in Russia and the Ukraine.

Now read:

Hackers jack Monster.com, infect job hunters

Find your next job with computerworld UK jobs