Widespread Internet Attack Cripples Computers with Spyware

An insidious new Internet attack that hijacks a victim’s Internet connection and stealthily installs a barrage of adware and spyware is targeting businesses and organizations across the United States.

The two-pronged attack, which has been ongoing since early March, has afflicted an estimated 20,000 computers, according to Ken Dunham, director of malicious code at IDefense, a Virginia-based Internet security company.

It starts with an assault known as DNS poisoning: Domain name system servers, which guide Internet traffic, are fooled into directing anyone heading to any .com Web site–for example, www.cnn.com or www.americanexpress.com–to a malicious Web site that the attackers control. That Web site then surreptitiously installs a wide range of adware and spyware on the victim’s computer.