MLB.com Major League Baseball Website Infected Visitors Through Ads

January 9th, 2009

MLB.com Major League Baseball Website Infected Visitors Through Ads

Major League Baseball’s website has been serving ads designed to infect its considerable base of visitors with malware. ScanSafe, a company that provides malware scanning for large companies, tracked banner ads served from the popular website for more than 72 hours.

The ads present visitors with a popup masquerading as a Windows dialog box that informs them their machine has been struck by spyware and offers a rogue anti-virus program that supposedly will fix the problem. ScanSafe researcher Mary Landesman said the outbreak was discovered on January 4. She searched in vain for a way to alert MLB administrators to the problem and spent the next couple of days watching helplessly as the attack continued unabated.

“They definitely don’t make it easy,” Landesman said. “Across the line, there really needs to be better accountability, in particular for sites that are really high profile.” It’s not the first time MLB.com has served malicious ads. In late 2007, ads dished out on the site performed drive-by downloads that silently infected many of its users.

According to The Register, MLB spokesman Matthew Gould said the tainted ads were the result of an individual who claimed to sell ads through a company the website has done business with before. After the scam came to light, MLB officials discovered this individual had no affiliation with the company, which Gould declined to name because he says MLB is pursuing legal action.

Gould said MLB officials believe the ads were taken down on Monday, less than 24 hours after going live. “As soon as we were made aware of the problem we removed the ad in all instances across our network,” he said.

Email, Bookmark or Share:

Latest News Updates

There have been a high number of Cold Fusion web sites being compromised in last 24 hours.

FCKeditor, a web based open source HTML text editor, suffers from a remote file upload vulnerability. A number of compromises have been reported as a result of the exploit being used prior to now.

The Twitter account belonging to venture capitalist and Mac evangelist Guy Kawasaki was hijacked yesterday and used to push malware to some 140,000 Twitter users. The attack included a link to what purported to be a sex tape video free download linked to Gossip Girls star Leighton Meester but, after a series of clicks, the end result was a malicious Trojan. View >>

After a blackhat SEO attack, cybercriminals are again using the terrifying catastrophe of Air France Flight 447 or about China-made C919 Jumbo Jets competing with Airbus and Boeing for malicious intent. This time, spam messages are sent with an attached PowerPoint presentation, which is specially crafted to exploit a vulnerability in Microsoft Powerpoint. View >>

A recent set of spam emails were seen abusing yet another Google search feature. Spam emails use search feature q=site: in order to direct the user clicking on the link to a Google results page returning a spam site. View >>

Latest Virus Descriptions

Trojan-Dropper.Win32.Agent.albv 15 Apr 2009 12:17:00 +040
This Trojan has a malicious payload. It is a Windows PE EXE file. It is 23552 bytes in size. Installation The Trojan copies its executable file as follows: %WinDir%\system\svhost.exe In order to ensure that the Trojan is launched automatically when the system is rebooted, the Trojan adds a link…
Backdoor.Win32.Agent.abgg 15 Apr 2009 12:15:00 +040
This Trojan provides a remote malicious user with access to the victim machine. It is a Windows PE EXE file. It is 22528 bytes in size. Installation Once launched, the Trojan copies its body to the Windows system directory as “digeste.dll”: %System%\digeste.dll In order to ensure that the Trojan…
Trojan-Dropper.Win32.Kido.a 15 Apr 2009 12:09:00 +040
This Trojan is designed to install and launch other programs on the victim machine without the knowledge or consent of the user. It is a Windows PE EXE file. It is 78848 bytes in size. It is written in C++.
Trojan-Downloader.Win32.Kido.a 18 Mar 2009 16:36:00 +040
This malicious program is a Windows DLL file. Installation The malware copies its executable file with random names to the following directories: %Program Files%\Internet Explorer\<rnd>.dll %Program Files%\Windows Media Player\<rnd>.dll %Program Files%\WindowsNT\<rnd>.dll %Program…
Email-Worm.Win32.Merond.a 12 Mar 2009 19:36:00 +040
This worm spreads as an attachment to infected emails and also via file-sharing networks and removable media. The worm itself is a Windows PE EXE file. The worm’s executable file can vary between 150KB to 400KB in size. Installation The worm copies its executable file to the Windows system…
Trojan.Win32.Agent.azsy 12 Mar 2009 19:29:00 +040
This malicious program is a Trojan. It is a Windows PE EXE file. It is 417792 bytes in size. It is packed using UPX. The unpacked file is approximately 439KB in size. It is written in C++. Installation Once launched, the Trojan copies its body to the current user’s Windows startup…
Trojan.Win32.Agent2.dtb 12 Mar 2009 19:23:00 +040
This Trojan calls premium rate numbers without the knowledge or consent of the user. It is a Windows PE EXE file. It is 25131 bytes in size. It is written in Delphi.
Trojan-Downloader.Win32.Small.ydh 24 Feb 2009 11:45:00 +040
This Trojan downloads other files via the Internet and launches them for execution on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 34816 bytes in size. It is not packed in any way. It is written in C++. Installation Once launched, the Trojan…
Trojan-Downloader.Win32.Agent.ahoe 24 Feb 2009 11:32:00 +040
This Trojan downloads another malicious program via the Internet and launches it on the victim machine without the user’s knowledge or consent. It is a Windows PE EXE file. It is 9216 bytes in size. It is packed using UPX. The unpacked file is approximately 38KB in size. It is written in…
Trojan-Downloader.JS.Agent.crh 20 Feb 2009 12:06:00 +040
This Trojan downloads other files via the Internet and launches them for execution on the victim machine. The program is an HTML page which contains Java Script scenarios. It is 1070 bytes in size.

CyberInsecure.com