Risk
12/11/2010
01:44 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Researchers: Major Ad Networks Serving Malware

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.Armorize chief technology officer Wayne Huang revealed in this blog post that two of the world's largest ad networks were actively serving malware and potentially infecting visitors to Web sites serving those ads. Millions of web users could had of been infected, Armorize CEO Caleb Sima told InformationWeek in an interview.

The payload in the attacks is a malicious program known as HDD Plus, which is a bogus system analysis and optimization program.

Armorize discovered the attacks on December 4 through its HackAlert offering. HackAlert is designed to identify Web sites and online advertisements infected with malware. The malware was served through JavaScript code transferred through online ads from DoubleClick, Sima said.

From their blog post on the attack:

Behavior: Users visit websites that incorporate banner ads from DoubleClick or rad.msn.com, the malicious javascript is served from ADShufffle.com (notice the three f's), starts a drive-by download process and if successful, HDD Plus and other malware are installed into the victim's machine, without having the need to trick the victim into doing anything or clicking on anything. Simply visiting the page infects the visitors.

Known sites affected: Sites that incorporate DoubleClick or rad.msn.com banners, including for example Scout.com (using DoubleClick), realestate.msn.com, msnbc.com (using both), and mail.live.com. We'd like to note here it's very possible that multiple exchanges, besides those listed here, have been serving the fake ADShufffle's ads.

Notice the three Fs in the name ADShufffle, it's a deft fake of the legitimate AdShuffle.

Here's a list of the exploits and malware used in the attack:

Initially with DoubleClick: 1) Internet Explorer iepeers (CVE-2010-0806)

Later with DoubleClick and rad.msn.com: 2) JDT: Java Web Start Arbitrary command-line injection (CVE-2010-0886) 3) Adobe Reader and Adobe Acrobat 9 GetIcon (CVE-2009-0927) 4) Microsoft MDAC RDS.Dataspace ActiveX (CVE-2006-0003) 5) Adobe Reader and Acrobat 9.x Doc.media.newPlayer () 6) Adobe Acrobat and Reader util.printf (CVE-2008-2992) 7) Adobe Reader GetMailInfo (CVE-2007-5659)

Malware installed: Over the past week, ADShufffle kept on changing the malware. Besides HDD Plus, other types of malware, such as backdoors, have been served. Later in the article we will provide links to our observed binaries.

Exploit packs used: Primarily a modified version of Eleonore. Neosploit was also used. With neosploit, malicious binaries are obfuscated on-the-fly before being served.

Not a trivial attack. And users who visited web sites serving the attack advertising were hit with the payload without having to click on anything; large web sites such as MSBC were affected; the exploits were well obfuscated; and according to Armorize, anti-virus vendors were very poor in initial detection rates.

Because these ads have the potential to be served to millions of web browsers, it's nearly impossible to determine how many people could have been infected. One thing that can be determined with more certainty: expect more of these kinds of attacks.

Such ad networks and other shared services, like web application widgets, have the potential to quickly hit millions of users. My bet is that it is only a matter of time before we see many more similar incidents.

While there's never any good news in such breaches, it's promising DoubleClick, Microsoft, and AdShuffle (the legitimate one) were able to quickly clamp down on the attack.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.