IFRAME SEO attack spreads to over a million search queries

By Janine de Blois

The IFRAME Search engine optimization (SEO) which began last week has spread and has infected an increasing number of important sites.

The latest high profile sites found to have the IFRAMES redirecting browsers to fake security software and Zlob malware variants are:

• USAToday.com
• ABCNews.com
• News.com
• Target.com
• Packard Bell.com
• Walmart.com
• Rediff.com
• MiamiHerald.com
• Bloomingdales.com
• PatentStorm.us
• WebShots.com
• Sears.com
• Forbes.com
• Ugo.com
• Bartleby.com
• Linkedwords.com
• Circuitcity.com
• Allwords.com
• Blogdigger.com
• Epinions.com
• Buyersindex.com
• Jcpenney.com
• Nakido.com
• Uvm.edu
• hobbes.nmsu.edu
• jurist.law.pitt.edu
• boisestate.edu

The hackers have been searching for popular keywords on sites and then adding a HTML command to the end of the search.

Website save copies of searches and submit them to Google in order to boost their ratings. These cached pages cause a victim to be redirected to the malicious sites.

Google has been removing the cached pages of some domains, but it is the sites themselves which need to be diligent in checking the search queries on their internal search engines do not contain malicious code.