computer science

Gumblar

Gumblar is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Gumblar rather than just read about it. In short: Gumblar is a malicious JavaScript trojan horse file that redirects a user's Google searches, and then installs rogue security software. Also known as Troj/JSRedir-R this botnet first appeared in 2009.

Key takeaways

Gumblar belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Gumblar to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Gumblar from memory before moving on to harder problems.

Reference excerpt

Gumblar is a malicious JavaScript trojan horse file that redirects a user's Google searches, and then installs rogue security software. Also known as Troj/JSRedir-R this botnet first appeared in 2009.

Infection

Windows Personal Computers Gumblar.X infections were widely seen on systems running newer MacOS operating systems. Visitors to an infected site will be redirected to an alternative site containing further malware. Initially, this alternative site was gumblar.cn, but it has since switched to a variety of domains. The site sends the visitor an infected PDF that is opened by the visitor's browser or Acrobat Reader. The PDF will then exploit a known vulnerability in Acrobat to gain access to the user's computer. Newer variations of Gumblar redirect users to sites running fake anti-virus software. The virus will find FTP clients such as FileZilla and Dreamweaver and download the clients' stored passwords. Gumblar also enables promiscuous mode on the network card, allowing it to sniff local network traffic for FTP details. It is one of the first viruses to incorporate an automated packet analyzer.

Servers Using passwords obtained from site admins, the host site will access a website via FTP and infect that website. It will download large portions of the website and inject malicious code into the website's files before uploading the files back onto the server. The code is inserted in any file that contains a <body> tag, such as HTML, PHP, JavaScript, ASP and ASPx files. The inserted PHP code contains base64-encoded JavaScript that will infect computers that execute the code. In addition, some pages may have inline frames inserted into them. Typically, iframe code contains hidden links to malicious websites. The virus will also modify .htaccess and HOSTS files, and create images.php files in directories named 'images'. The infection is not a server-wide exploit. It will only infect sites on the server that it has passwords to.

Gumblar variants Different companies use different names for Gumblar and variants. Initially, the malware was connecting to gumblar.cn domain but this server was shut down in May 2009. However, many badware variants have emerged after that and they connect to other malicious servers via iframe code. Gumblar resurfaced in January 2010, stealing FTP usernames and passwords and infecting HTML, PHP and JavaScript files on webservers to help spread itself. This time it used multiple domains, making it harder to detect/stop.

Worked examples

Example 1 — a first encounter with Gumblar

Start with the simplest possible case. Write down what Gumblar claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Gumblar before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Gumblar ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Gumblar

In research: Gumblar appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Gumblar in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Gumblar is common in secondary-school and first-year university syllabi. It links to neighbouring topics Botnets, Distributed computing projects, Internet security, so understanding it makes those chapters shorter.
In everyday life: Look for Gumblar outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Gumblar in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Gumblar means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Gumblar out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Gumblar in simple terms?

Why does Gumblar matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Gumblar?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Gumblar.