Another malware pulls an Italian job
Remember LINKOPTIM, which exploited a number of legitimate Italian Web sites to spread malicious JavaScripts? Since early Saturday morning (June 16, 2007), Trend Micro has been receiving several reports of a new batch of hacked Italian Web sites …
Context & Ripple Effects
Trend Micro's alert extends a pattern the vendor had already documented: the LINKOPTIM campaign exploited legitimate Italian Web sites to serve malicious JavaScripts, and the new batch of hacked sites reported starting Saturday, June 16, 2007 follows the same playbook. The speed of pickup is notable — CNET News.com, Websense Security Labs and Security Fix all covered the wave on or about the same day, with Security Fix identifying the MPack exploit tool as the payload being slipped through unpatched holes.
First-order effects
- Visitors to compromised Italian sites are silently redirected through MPack-style exploit kits that probe their browsers for unpatched vulnerabilities, meaning ordinary browsing of trusted domains becomes an infection vector.
- Site operators of the affected Italian domains face emergency cleanup and reputational damage, while Trend Micro and peer vendors scramble to push detections for the injected scripts.
Second-order effects
- The low effort and high yield of hijacking legitimate, well-trafficked sites invites copycats: every attacker watching this wave learns that compromising trusted hosts beats spamming malicious links directly.
- Enterprises respond by re-evaluating trust models — allowing employees to browse mainstream Web sites is no longer equivalent to allowing safe content, pressuring gateway and reputation-filter vendors like Websense to treat popular sites as suspect.
Third-order effects
- If the pattern holds, Web-borne malware industrializes around rented exploit toolkits such as MPack, shifting attacker economics from bespoke infections to volume drive-by attacks against any compromised domain regardless of geography or topic.
- The erosion of 'legitimate site = safe' assumptions pushes the industry toward layered defenses — browser patching cadence, URL reputation systems, and behavior-based detection — because signature-only antivirus cannot keep pace with server-side script rotation.
The trend: Mass compromise of legitimate Web sites to distribute toolkit-driven drive-by exploits is emerging as the dominant Web malware delivery model of 2007, replacing direct malicious-link distribution.