Up to 5 million domains -- not just web pages -- were infected by a
malware-spewing widget, according to security experts at web
application security vendor Armorize Technologies.
On Thursday, Armorize said that it had been receiving urgent client
inquiries -- including one from its largest customer -- asking why
their web pages were being flagged by Armorize's hack-alert service
as generating malware.
Armorize traced the malware back to the "Small Business Success
Index" widget offered by Network Solutions on its GrowSmartBusiness
website. The widget was also available via Widgetbox, a
widget-hosting website.
"We verified that the domain growsmallbusiness.com was definitely
compromised and injected with a r57shell (webshell), which allowed
the attacker easy manipulation of the site," according to a blog
post from Wayne Huang, president and chief technology officer of
Armorize, and his colleagues.
Both Network Solutions and Widgetbox have since removed the widget
or taken the relevant sites offline. Prior to that, the widget had
been installed more than 5,300 times just from Widgetbox.
On Saturday, however, after studying the widget further, Huang said
he discovered that the malicious widget wasn't confined to those
two websites, but somehow was also "part of the standard domain
parking page of Network Solutions."
How many affected domains were out there? A search of Google
reveals at least 500,000 instances of parked Network Solutions
domain pages, while Yahoo says there are 5 million.
On Monday, Network Solutions pulled the plug on the malicious
widget, said Susan Wade, the company's director of public
relations. "The widget link that appeared on the parked page master
template has been removed, therefore the widget no longer appears
on any Network Solutions' parked page."
In a statement released Monday, the company also disputed the
number of domains affected. "The number of impacted pages that have
reported publicly over the weekend are not accurate. We're still
investigating the number of web pages affected." The company said
it would release an update on its investigation on Tuesday.
Meanwhile, for anyone who added the GrowSmartBusiness widget to a
website, "we recommend you delete that widget and scan your site
for malware," said Network Solutions.