As the Spring 2010 class leaves for Summer Break, one last jab:

via switched.com via AVG via Computer World

Not that you needed any further proof that no one is safe from a dedicated hacker, but here’s yet another tale of Internet swindlers infecting a highly trusted site.

Roger Thompson, a researcher at AVG, discovered on Monday that three sites belonging to the U.S. Treasury Department had been hacked, and were infecting visitors with malware. According to Thompson, the attackers embedded a simple piece of nearly undetectable HTML that quietly redirected users to a website in the Ukraine, via an iframe (a method of embedding one site inside another). That embedded page used a commercially available malware kit called Eleonore Exploit pack. The exploit pack attempts to find a way into a PC by using several different known methods of attack, including flaws in Adobe Reader.

As of late Monday night, the malicious code had not been successfully scrubbed from the Treasury site, but the IT staff was aware of the issue and working towards a remedy. In the meantime, it’s strongly urged that you avoid visiting the Treasury site — even if you still haven’t seen that epic video of the new $100 bill. Besides, you can find it on (the presumably safe) YouTube.

For 2 brownie points – is that a stored or a reflected XSS? Have a nice break!