Daily cyber threats and internet security news: network security, online safety and latest security alerts
July 4th, 2009

Multiple Popular Websites Affected By EyeWonder Malware Incident

According to ZDNet, during the last couple of hours, visitors of popular and high trafficked web sites such as CNN, BBC, Washington Post, Gamespot, WorldOfWarcraft, Mashable,,, AndroidCommunity, Engadget and, started reporting that parts of the web sites are unreachable due to malware warnings appearing through the EyeWonder interactive digital advertising provider.

According to Google’s SafeBrowsing advisory for EyeWonder, the exploits were hosted on currently active and participating in the Cold Fusion injection attack domains, namely elfah .net, 2ici .cn and javazhu.3322 .org – the following have also managed to compromise Pakistan’s Telecommunication Authority.

By using RealPlayer Import stack overflow exploit and another one attempting a QVOD Player URL overflow, the cybercriminals then attempt to push eight different malware samples. Detection rates for the droppers are improving.

Interestingly, one of the malware samples attemps to download the updated list of malware binaries by connecting a compromised Italian site part of the Cold Fusion injection attacks ( since it appears to have been exploited in such a way.

This malware incident demonstrates how a single exploitation of a trusted third-party content/ad serving vendor can not only undermine its credibility, but potentially the credibility of the sites using the network. And since the ads on the affected sites are dynamically served through different networks, it remains questionable whether it was in fact EyeWonder that served malicious content, or a compromised partner of the network itself.

Case in point – the partnership between Facilitate Digital and EyeWonder comes in a very insecure fashion with EyeWonder having a permanent iFrame tag loading a domain ( belonging to Facilitate Digital on its front page.

For the time being, remains down for maintenance.

Credit: Security Blogs

Share this item with others:

More on CyberInsecure:
  • Multiple TechCrunch Websites Compromised, Infect Visitors With Malware
  • Houghton Mifflin Harcourt Server Breached In Mass Web Attack
  • Malicious Javascript Code In Another CNET Networks Website
  • Heinemann-Raintree Reports a Year And A Half Old Breach in Their E-commerce Website
  • TweetMeme Hit By Malvertisement, Users Redirected To Fake Antivirus Pages

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Multiple Popular Websites Affected By EyeWonder Malware Incident

    One Response to “Multiple Popular Websites Affected By EyeWonder Malware Incident”

    1. Apparently, the exploit only affected the home page and not any advertising, which was hosted on a different server (which can be verified by traceroutes). The warnings on other sites were simply because Google flagged *

      It looks like Eyewonder has fixed the issue caused by the hack into Coldfusion on their home page and Google has unflagged them.

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.