Blog
In my last Gumblar blog, I provided a chart showing the number of compromised sites topping out at approximately 22,500 on May 17, 2009. Here is that chart:
Original Chart of Gumblar Injection and Matches:
Now that Websense Researcher's have had more time to follow and track the compromised sites, I want to update people on how widespread the Gumblar attack really is.
Updated Chart of Gumblar Injection and Matches:
In the newer chart, the value peaks at approx 82,500 on May 26, 2009. This number eclipses the older value and truly illustrates how fast this attack spread.
Updated Chart of Older Injection and Matches:
As shown above, the predecessor to the Gumblar attack is still alive, but it is on the decline. The older injection peaked at approx 17,000 sites on April 25, 2009. This peak was in the earlier days of the attack; it has since then stabilized at about 10,000.
Updated Chart of Gumblar vs. Older Injection and Matches:
So far, most of the data I have given in this blog has been an update to previously discussed items. The next graph offers something new.
Chart of Gumblar vs. Other Compromised:
This graph shows that although Gumblar is the single most widespread destination site, it's still a drop in the bucket in the overall compromised Web site landscape. However, keep in mind that there is a difference between how widespread a compromised Web site attack is and how frequently the compromised sites in the attacks are visited.
Security Researcher: Ali Mesdaq
