It is not apparent how the malicious code got onto the site. Either hackers successfully attacked the site and added the code or existing code was exploited to add the script.
The offending code directed users to another infected WordPress site where an exploit kit would be run to find vulnerabilities in the users’ computer. Then the Dorkbot malware steals usernames and passwords by spying on activities you perform online.
A spokesperson for the Jamie Oliver Group played down the seriousness of the issue when talking to the BBC. The issue has now been fixed but the site typically receives 10 million visitors per month, leading to the question of how many people could have been affected.
The spokesman confirmed that code on the site had been modified by a hacker and that the site’s developers were still trying to ascertain how access had been acquired. The spokesman stated that no data had been compromised during the attack. The spokesman described the issue as a “low-level malware problem,” saying “The Jamie Oliver website is regularly checked for vulnerabilities by both our in-house team and an independent third party, and they quickly deal with anything that is found. The team is confident that no data has been compromised in this incident, but if anyone is worried do please use the contact form on the site. We apologise to anyone who was at all worried after going on the site.”
Jerome Segura of Malwarebytes uncovered the malicious script which tried to exploit several vulnerabilities in third-party browser plugins Adobe Flash, Microsoft Silverlight and Oracle Java.
The site is now safe to use again but people who have visited it recently are advised to ensure that their anti-virus software is updated and protecting against threats in case their system has been infected by the malware.
