How easy is it to inject malware into websites?

Question

Please let me present you with a hypothetical scenario. A journalist is targeted by hackers. Said journalist is very careful with email attachments and will not click on them. However, surfing the web is full of risks. I have two questions that maybe you could answer?

• The hackers know that their victim is into, say, tennis and that he or she may visit tennis blogs and forums. How easy would it be to inject, say, hundreds of tennis-themed websites with malware AND then identify their victim among thousands of visitors/clicks?
• The more general question is what percentage of mainstream websites can actually be injected with malware. How easy is it to just plant a virus wherever you want? By mainstream websites, I mean top results on Google or Bing.

Answer 1

There is no defined scale for "easy" or "hard" inject malware into a website. But for most sites one can probably say that it is possible if the attacker is willing to spend enough effort, time or money.

Apart from actually hacking the site it might be easier to attack the user through the ads hosted on these sites. These personalized ads are provided through ad networks and allow fine grained targeting of the victim with malicious ads. This kind of Malvertising is for example currently done using Google Ads, see Google ads lead to major malvertising campaign.

It is also common that attackers place ads in the search engines and thus show up there on prominent positions, see FBI warns of search engine ads pushing malware, phishing.

Answer 2

What you're describing is a very implausible scenario:

• Hacking a single website takes a considerable amount of expertise and money
• OK, you've done that, for how long do you think this website will be able to spread malware? Not for long, multiple visitors will notice they are being hacked, and the website will be reported to AV vendors, web browser vendors, and this website hosting provider. Firefox and Chrome will show a big fat "The website you're trying to visit contains malware" warning and will stop you from opening any pages, the hosting provider will most likely take it down.
• You're under the impression that hacking websites is a breeze. No, it's not, which is proven by the fact that exploits for certain vulnerabilities cost up to $200,000.
• You've mentioned "hundreds of tennis-themed websites" - this is outright technically impossible.

As a journalist here's what you need to do:

• Do enable DoT/DoH in your system.
• Keep your OS up to date. Never disable Secure Boot. In a perfect world, all the data (except the EFI system partition) on your disk should be encrypted. You can actually get away with no EFI system partition by booting off a USB flash drive - this way you may encrypt your drive entirely.
• Keep your web browser up to date. If you're really paranoid, start using development versions of web browsers because they receive patches faster.
• If you're using websites you're afraid to spread malware, browse them via a virtual machine (e.g. VirtualBox, VMWare, etc.) or/and a remote PC via e.g. RDP/Encrypted VNC. Multiple companies on the net offer such PCs.
• You'll be better protected if you stop using Windows and start using e.g. Linux. Most malware target Windows products, while Linux distros are all slightly different, and targeting them all at once is nearly impossible.
• Make sure you never lose sight of your laptop. It's a ton easier to plant hardware exploits, e.g. a hardware keyboard logger than to target the websites that you may visit.
• Never open any email attachments directly on your PC.
• If you're using Mozilla Thunderbird, disable "Original HTML" for Message Body and switch to Plain Text.