Internet attack warning
p2pnet.net News:- End-users should disable JavaScript “unless it is absolutely necessary,” warns the US Department of Homeland Security.
“US-CERT is aware of new activity affecting compromised web sites running Microsoft’s Internet Information Server (IIS) 5 and possibly end-user systems that visit these sites,” says the DoHS here. “Compromised sites are appending JavaScript to the bottom of web pages. When executed, this JavaScript attempts to access a file hosted on another server. This file may contain malicious code that can affect the end-user’s system.”
Or as an Associated Press states it here, “Government and industry experts warned late Thursday of a mysterious, large-scale Internet attack against thousands of popular Web sites. The virus-like infection tries to implant hacker software onto the computers of all Web site visitors.”
Now, “Web server administrators running IIS 5 should verify that there is no unusual JavaScript appended to the bottom of pages delivered by their web server,” says the DoHS.
“This activity is another example of why end users must exercise caution when JavaScript is enabled in their web browser. Disabling JavaScript will prevent this activity from affecting an end-user’s system, but may also degrade the appearance and functionality of some web sites that rely upon JavaScript.”
Users should, “be aware that any web site, even those that may be trusted by the user, may be affected by this activity and thus contain potentially malicious code.”
However, the AP story quotes the Internet Storm Center’s Marcus Sachs as pointing out that, “While this is significant, it has no impact on the operation of the Internet.”
US-CERT is investigating the origin of the IIS 5 compromises and the impact of the code that is downloaded to end-user systems, says the DoHS.
In the meanwhile, JavaScript, a scripting language introduced by Netscape, is not to be confused with Java, a Sun Microsystems programming language.
