It was discovered that GovTrip.com, a website used by federal government employees for booking travel reservations was hacked and serving up malicious code through redirects.

The site is currently unavailable as they perform their forensic investigation and clean up the mess.

According to reports, “sometime” before February 11th, cybercriminals compromised the site and inserted redirect code that sent visitors to a website serving up malicious code. The site is used by such government agencies as: the US Environmental Protection Agency, departments of Agriculture, Energy, Health and Human Services, Interior, Transportation and Treasury.

The website is also used to reimburse employees for travel expenses so all sorts of information is stored there, however, it is not yet known what information was compromised during this breach. I personally don’t think the cybercriminals would have done both – insert redirect code and steal the data available. If the cybercriminals thought the data was valuable, they probably wouldn’t have risked inserting the redirect code as this could have, and did, alert others to the compromise.

The GovTrip.com website is managed by defense contractor Northrop Grumman.

The site had been blocked when the proper authorities were notified. Government agencies using the website were issuing warnings which could have only exacerbated the situation due to human curiosity. Frequently, when you tell a large number of people not to do something, you’re going to get a large percentage of those people to do exactly what they were told not to do.

Cybercriminals know this and use it all the time.

Not to be left out of the upcoming festivities, hackers are using SEO to infect more people with their fake Anti-virus programs.

For the past week we’ve been monitoring 2 current events – Halloween and the financial crisis.

What we’ve seen is that hackers are infecting legitimate websites that show up in the SERPs when “halloween costume” is the the search term. Their infection includes some javascript that does a silent redirect to one of their websites which falsely shows the visitor that their computer might be infected and they should download “their” anti-virus software to improve the speed of the visitor’s computer.

The thing is, the infection of the legitimate website is a silent redirect that actually includes the keywords optimized for high SE rankings. So the hacker is actually making the infected webpage rank higher in the search engines. They actually use common SEO techniques to attract more people to their infectious webpages.

Another thing we’ve seen and has been confirmed by Panda Labs is the correlation between down days in the stock market and the amount of new malware released. As the market dips, the number of infectious files increases. We’ve been noticing this on our honeypots (computers we leave open on the Internet hoping they’ll get infected so we can further analyze the infection)

This kind of runs parallel with the halloween costume scenario. What the hackers are doing during the dips in the market are making “available” their rogue (read fake) anti-malware software via various infected webpages.

Instead of going after banking logins and other such useful information they’re (the hackers) interested in “legitimitizing” their business by selling their rogue anti-malware. First they have to convince the visitor that their computer is infected, then they offer an immediate solution.

Ingenious!

Following standard marketing strategies, the hackers are actually making the visitor aware of a need and then offering a quick solution – for $60.

According to Panda Labs, they estimate that this marketing strategy has made the hackers approximately $14 million a month. I’m not sure I follow their math, but regardless, the hackers are making money.

I believe that the financial crisis is creating more fear about identity theft and therefore making this strategy more effective during the down cycles in the market.

Just so you know, our honeypots are fed popular keywords based on current events and then they visit the resulting webpages, record the activity and that’s what we base our information on.

It’s a fun way of spying on the hackers and it’s what we use in our securitiy appliance “The Box” to blacklist websites and malicious code. It’s what we use in WeWatchYourWebsite to find malicious code. We then search all of our clients websites looking for this malicious code. If any is found, we alert them immediately.

Be careful out there. It’s getting real nasty.