'Gumblar' PC virus targets Google users, warn experts

A computer virus that targets Google users is mutating rapidly, turning it into what some are calling the biggest threat to online security today.

The worm, known as Gumblar, attacks computers through vulnerabilities in some version of Adobe’s PDF reader and Flash player software.

Once it infects a victim’s Personal Computer, it silently redirects the user’s Google search results to sites that download more malware onto the machine or allow criminals to conduct “phishing” attacks to steal login details for banking, social networking and websites.

Gumblar has begun to spread through websites where passwords or software have previously been compromised, so that visitors to the sites are unwittingly infected without realising it – a so-called “drive-by download exploit”. Infected PDF documents and Flash films on the site attack the victim’s PC.

Although Gumblar has been known about some time, its activity has increased rapidly in recent weeks. The unidentified writers behind the program have changed its mode of attack, so that it draws malicious code from a web page based in China, and have developed new techniques to avoid being spotted.

“The Gumblar attacks have morphed again,” said Mary Landesman, a senior security researcher with ScanSafe. “What we’re really looking at here can only be described as a botnet of compromised websites. And a growing one at that.”

Scansafe is recommending that people concerned about the security of their own sites should visit a third-party site called “Unmask Parasites”.

The updated version of Gumblar has also been tweaked to more effectively target users of  Google’s Chrome browser, by avoiding its built-in blacklists of suspicious websites.
Last week instances of Gumblar across the web increased by almost two-and-a-half times, while security company Sophos says it was responsible for 42% of all cases of malicious code found on websites.

The speed of the Gumblar infection has already led to a series of warnings from senior security figures.

The US Computer Emergency Readiness Team (CERT), the organisation responsible for online security in the United States, issued a warning about Gumblar earlier this week, encouraging users to apply software updates to protect themselves. While website administrators and Windows users struggle with the spread of Gumblar, meanwhile, security has become a hot topic for Apple users once again, after it emerged that a vulnerability in the way Mac computers run Java remains unplugged despite being made public six months ago.

The hole, which potentially allows criminals to run malicious code on their victim's computers, was first discovered in 2008 and has been used in hacking competitions.
Earlier this week, former Apple engineer Landon Fuller demonstrated a proof of concept that used to execute code without a user’s permission, arguing that “many Mac OS X security issues are ignored if the severity of the issue is not adequately demonstrated”.