International. The security service provider has discovered a protection for the massive attack against about ten thousand websites using Linux/Apache servers, in the UK, India and other English-speaking places.
Infected servers cannot use QuickTime or MDAC utilities (using XMLHTTP and ADODBStream), slides (heapspray), VML (key framework), SuperBuddy (AOL, LinkSBIcons), AudioFile (NCTsoft), GOM (GomManager openURL), WebFolderView (SetSlice), Yahoo! Messenger (receive file), among others.
There is evidence that the attack uses the compromised FTP and CPanel credentials. Thus, the attacker installs a code that modifies the Apache memory to monitor the requests and inject the programming tag. If the code infects the Apache execution process, it can reproduce new, uninfected processes to handle more requests. To justify that, the code redirects the system call for all running Apache processes using the RPI (Running Infection) technique.
To protect themselves from attack, organizations must disable loading in their module configurations. Visitors, meanwhile, can avoid infections from the malicious code by making sure they have all their antiviruses updated and that all vulnerable software has security patches, as no unknown vulnerabilities have been used.
Some signs point to an origin of the attack in Western Europe or North America, but the investigation continues.
