Samsung Web site hosts password stealing trojan

update Samsung's US Web site is hosting a Trojan horse that logs keystrokes, disables antivirus applications and steals online banking access codes, according to Internet security firm Websense.

Visitors to the Web site are not affected by the malware and Websense believes Samsung's Web server has most likely been compromised in order to serve malware to users that receive spam messages or malicious IM messages.

Joel Camissar, Australian country manager for Websense, told ZDNet Australia that Samsung has been informed about the issue but has not yet removed the offending files.

"As of this morning [Sydney time] the malicious code on the Web site was still active," he said.

According to an advisory published by Websense, "The server appears to have been compromised and has been hosting a variety of files for some time. The most current code, which is still available for download, is a Trojan Horse that attempts to disable antivirus programs, modify registry keys, download additional files, and log keystrokes when connecting to banking Web sites."

Camissar admitted that it was possible that the hackers who compromised Samsung's servers would have been able to modify the company's Web site so visitors using a vulnerable browser would become automatically infected with the malware.

"Why not hack into a site that people are visiting that is a trusted brand? Trust is so important these days. People are being preached to by banks not to trust links [in unsolicited emails] -- that is something people are starting to follow. So if one does go to a site that is trusted, it is certainly a very easy way for hackers to compromise users," added Camissar.

Earlier this week, Dave Cole, director of Symantec Security Response, warned on his blog that hackers are exploiting Web technologies such as Ajax and JavaScript to compromise "trusted" Web sites with malware.

"It's worth noting that most high-impact attacks may be performed on popular sites where someone has embedded an attack in an otherwise benign location for user-created content, advertisements, or comments.

"Sure, there will be enticements to bring people to outright nasty sites loaded with exploits, but a more successful and insidious attack would leverage a person's trust of an already known, popular site," wrote Cole.

Cole said it is still early days for these kinds of attacks: "From port scanning to fingerprinting and basic network mapping, all done using the AJAX group of technologies, it's clear that we've only begun to see what's possible via malicious Web sites".

"While they may not have the immediate impact of a WMF-style vulnerability (ie: remote admin-level control), they leave no trace once the browser is closed and don't rely on a researcher uncovering a Godzilla-style hole in a popular Web browser," he added.

Last month, the School of Media, Film and Theatre at the University of NSW admitted that one of its Mac servers had been compromised and used to host a potentially malicious file, which was disguised as a Microsoft security patch.

Samsung was unavailable for comment.