I just got through reading about another hugely popular, legitimate Web site hosting malicious code that redirects visitors to a malicious Web site. Once redirected, the new Web site runs a fake virus scanner and -- surprise, surprise -- finds multiple malware programs on the user's computer as it offers to install new "anti-virus" software to the end-user. Of course, users foolish enough to install the software end up installing what is likely to be the only malicious program on their computer.
Gone are the days when you could tell your end-users not to visit "untrusted" Web sites to minimize their exposure to malware. Actually, I gave up on that advice during the Nimda worm attack of September 2001. That was the first time a legitimate Web site tried to infect my computer. These days it is plausible to say that a fairly large percentage of malware is launched against us from innocent, victimized Web sites.
In the latest attack I'm referencing, the malicious attacker placed a malicious Macromedia Flash object on the vendor's Web page. (I also remember the days when media content couldn't hurt you.) How it got there I don't know, but it likely was placed using a Web site vulnerability or malicious ad placement. It might well have been one of the many cases in which you'll find a case of inappropriate transitive trust.
In the computer security world, transitive trust refers to how much implied security trust Party A gives to Party B when acting on behalf of Party A to Party C. Party A expects Parties B and C to use the same security policies and effort as it would use itself in all instances, or perhaps even more. In reality, Party A often assumes too much and fails to impress on the subsequent parties its expected security requirements. And when the compromise or vulnerability hits the news headlines, Party A is left swinging alone in the wind to face the music.
A common transitive trust scenario happening over and over today involves the placement of malicious banner ads on legitimate Web sites. The original Web site owner has a popular Web site and wants to maximize revenue. Often this is accomplished using revolving banner ads. On a big site, it is rare that the Web site administrators actually post or sell the majority of the banner ads themselves. Instead, they contact a trusted, accomplished, often traditional advertising firm to handle request (that is, the first transitive trust baton passing). This first-line trusted firm, not specializing in Internet media, contacts a medium-sized firm specializing in Internet advertising (the second baton pass). This midsize firm then contacts an even smaller firm that specializes in selling banner advertisement (the third baton pass), who promises top-dollar banner ads. The smaller ad firm ends up getting a top-dollar bid for the ad space, not realizing that the top bidder is a front company for a crimeware syndicate.
