It's now a popular way of trying to load malware onto users' PCs without them going to an evil or compromised website. In fact, they only have to click on a link in a Google search for a popular site, where the exploit has been preloaded. Sites affected include USA Today, Wal-Mart and ZD Net Asia, but it's spreading.
An IFrame (which isn't another Apple product - it stands for "inline frame") is just a way of loading one web page inside another, usually fro m a different server. That can be useful for building online applications. But malware writers can make the included page just one pixel square - meaning you can't even see it's there - and obfuscate the JavaScript that will run automatically fro m that included page so that it looks something like %6C%20%66%72%61%6D%65%62%6F - leaving no obvious clue that it's malicious.
When this idea got going, the IFrame code would be inserted by hacking web servers, or adding it to banner advertisements. Over the past six months, however, there has been a huge growth in the use of "poisoned" search results.
Big websites often cache (store) the results of search queries run on their sites - say, the links for a search for "malware IFrame" - and then forward these to search engines such as Google, which can generate search results directly. Malware authors exploit the system by putting in a search query like "malware IFrame" plus all the malicious IFrame's text. If the site doesn't check search terms adequately for obfuscated Javascript, the IFrame data is stored and passed on. When someone then searches for "malware IFrame" and clicks a result, the attack is initiated directly fro m the search result, because the browser can read the obfuscated Javascript - even if you can't.
Malware distributors like this because they don't need to hack the server, and can use popular searches to benefit fro m the site's SEO (search engine optimisation) practices and get a high ranking at Google. The attack usually includes half a dozen "drive-by" exploits, and also uses "social engineering" to get users to install something else, such as a video codec that is actually a Trojan. Windows users without the IE security update MS04-040 (fro m 2004!) are particularly vulnerable. There seem to be lots of them.
How can the attacks be stopped? Sites that cache searches must improve their input checking, and server operators can search for IFrame exploit code. Google is trying to remove malware search results, and automatically detects some exploits and warns that "This site may harm your computer".
Windows users should make sure they have installed all security updates, and preferably upgrade to XP SP2 with IE7, or Vista. Running an active anti-malware guard can also help. That should just leave the people dumb enough to think they need to install a new codec to view porn.
Download this Document for detailed instruction to handle this issue
