TechCrunch Reinfected with Malware

If you have visited the TechCrunch Europe site in the past days you will want to make sure you didn’t accidentally download any malware. The latest reports from TechCrunch say that the problem has been fixed but the website was redirecting visitors to a server serving up malicious PDFs.

ComputerWorld notes that at the core of the infection was a malicious iFrame in a JavaScript file that was used by the site as part of its WordPress blogging software installation. Once downloaded and run, the PDF files exploited a vulnerability and made the system download a version of the wide-spread Zeus Trojan.

According to a researcher at Trend Micro, only 2 out of 43 anti-virus engines would detect the malware that infected TechCrunch. At Dasient, we believe it is important to use behavioral analysis, and not rely on anti-virus engines or signature-based approaches, to detect web-based malware. At the heart of Dasient’s services is a behavioral scanning engine that analyzes the behavior of a web page or ad creative to detect whether malware is being served to users. Our behavioral scanning engine detects “zero-day” malware infections on websites and advertisements when the traditional signature-based anti-virus approaches fail.

Like other popular web destinations, TechCrunch has become an attractive target for the cybercriminals who wish to infect the site’s users with viruses. TechCrunch was also hacked in March of this year, when the site was serving malicious ads. In this case, rather than being a victim of “malvertising,” the site was compromised by what appears to be an exploit of its WordPress software. Earlier this year, there was a mass attack where attackers exploited a vulnerability in WordPress to infect thousands of websites with malware. Unfortunately, there are a number of ways that websites can be attacked, ranging from malicious ads delivered by their ad network, to compromised third-party software, to widgets that have been hacked and infected with malware. When this occurs, the attacked websites suffer losses of customers, traffic, and ultimately brand and revenue. It is therefore critically important for publishers and other websites to regularly scan both their ads and their content for malware using behavioral detection technology, such as Dasient’s Web Anti-Malware and Anti-Malvertising services.