Stealth Attack Targets Apache Web Server
The attack uses Apache's built-in filter capabilities to include links to malicious websites.
The attack uses Apache's built-in filter capabilities to include links to malicious websites. Mullaney explains:
All of the actions performed by the rogue module are done using legitimate code provided by the Apache API ... This is not an exploit or a hack of Apache's code base; the module uses Apache's inherent functionality to infect users and attempts to redirect them to a malicious Web page.
However, the module doesn't infect every Web page it serves, which would draw the attention of system administrators. Mullaney calls this "a complex and potentially difficult threat to detect accurately" because the module contains a number of evasion techniques. On the bright side, for an attacker to install this module, they would need administrator-level access.
