The attack looks like a regular pop-up warning, except in this case, users are faced with a window that warns them away from the current webpage and directs them to a different site to purchase antivirus software.
Security expert call this technique "scareware," and even the largest sites online are susceptible to it. Readers of the New York Times online portal encountered scareware this week. Admins at NYTimes.com discovered, however, that their site wasn't infected — its advertisements were.
This technique differs from traditional attacks, where the site itself is the target, researchers said.
"I think there is a problem with ad networks, in general," said Graham Cluley of the Sophos security firm. "The problem really is with websites handing over control of some of their content to third parties."
But with NYTimes.com, the plot thickened. Apparently the hackers initially posed as an ad network that represented mobile carrier Vonage. NYTimes.com accepted the ad and placed it on its site. Later, the hackers switched out the Vonage ad with the malicious one.
The websites for the San Francisco Chronicle and Fox News have both been victims of this style of scareware.
Online executive Troy Davis offered detailed technical analysis of the attack on NYTimes.com. Davis, CEO of the online development firm Seven Scale, noted that the scareware successfully imitates a local security program to trick users into following its commands.