On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK. I have several questions about this malware, however I prefer to ask only few of them since I already found answsers for other questions:
- I take this quote from this article:
While the userprefs.js code was served to all visitors, only some of those people received an additional payload that contained malicious iframe tags
As I am working around the security of browsers such as FF, GC and IE, I wonder how come a website can legitimately writes into the profile of a Firefox user and writing into its
userprefs.js ? How come is this dangerous behavior is a normal thing used by php.net servers ?
- Always from the quote: are the
iframesin such cases ALWAYS hidden ?
- From the same article, I have a question about this quotation:
some webserver malware runs entirely in memory and hides itself pretty well.
How come a virus can hide itself by running within a memory ?