Scareware Traversing the World via a Web App Exploit

In July 2009, several Irish websites were attacked and had malware code injected into them. These (compromised) websites redirected end-users to malicious websites, which subsequently served malware to anyone who browsed to the original legitimate sites. The notification of this compromise resulted in me beginning the Incident Handling Process.The subsequent investigation into the complex infrastructure behind, what initially appeared to be a simple website compromise prompted this paper. The paper will walk through the various stages of the (SANS GCIH) Incident Handling Process explaining how it pertains to this particular attack.Additionally, the paper will show that whilst 'scareware' has been around for a few years, it is becoming a growing threat, incorporating an increasing amount of attack vectors and has ultimately become a very effective attack method for criminals in getting funds. In fact, the paper will detail how this scareware imitated the infamous 'Blue Screen of Death' and subsequently show that it became very prevalent, very quickly across the worldwide