Risk
12/11/2010
01:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Researchers: Major Ad Networks Serving Malware

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.Armorize chief technology officer Wayne Huang revealed in this blog post that two of the world's largest ad networks were actively serving malware and potentially infecting visitors to Web sites serving those ads. Millions of web users could had of been infected, Armorize CEO Caleb Sima told InformationWeek in an interview.

The payload in the attacks is a malicious program known as HDD Plus, which is a bogus system analysis and optimization program.

Armorize discovered the attacks on December 4 through its HackAlert offering. HackAlert is designed to identify Web sites and online advertisements infected with malware. The malware was served through JavaScript code transferred through online ads from DoubleClick, Sima said.

From their blog post on the attack:

Behavior: Users visit websites that incorporate banner ads from DoubleClick or rad.msn.com, the malicious javascript is served from ADShufffle.com (notice the three f's), starts a drive-by download process and if successful, HDD Plus and other malware are installed into the victim's machine, without having the need to trick the victim into doing anything or clicking on anything. Simply visiting the page infects the visitors.

Known sites affected: Sites that incorporate DoubleClick or rad.msn.com banners, including for example Scout.com (using DoubleClick), realestate.msn.com, msnbc.com (using both), and mail.live.com. We'd like to note here it's very possible that multiple exchanges, besides those listed here, have been serving the fake ADShufffle's ads.

Notice the three Fs in the name ADShufffle, it's a deft fake of the legitimate AdShuffle.

Here's a list of the exploits and malware used in the attack:

Initially with DoubleClick: 1) Internet Explorer iepeers (CVE-2010-0806)

Later with DoubleClick and rad.msn.com: 2) JDT: Java Web Start Arbitrary command-line injection (CVE-2010-0886) 3) Adobe Reader and Adobe Acrobat 9 GetIcon (CVE-2009-0927) 4) Microsoft MDAC RDS.Dataspace ActiveX (CVE-2006-0003) 5) Adobe Reader and Acrobat 9.x Doc.media.newPlayer () 6) Adobe Acrobat and Reader util.printf (CVE-2008-2992) 7) Adobe Reader GetMailInfo (CVE-2007-5659)

Malware installed: Over the past week, ADShufffle kept on changing the malware. Besides HDD Plus, other types of malware, such as backdoors, have been served. Later in the article we will provide links to our observed binaries.

Exploit packs used: Primarily a modified version of Eleonore. Neosploit was also used. With neosploit, malicious binaries are obfuscated on-the-fly before being served.

Not a trivial attack. And users who visited web sites serving the attack advertising were hit with the payload without having to click on anything; large web sites such as MSBC were affected; the exploits were well obfuscated; and according to Armorize, anti-virus vendors were very poor in initial detection rates.

Because these ads have the potential to be served to millions of web browsers, it's nearly impossible to determine how many people could have been infected. One thing that can be determined with more certainty: expect more of these kinds of attacks.

Such ad networks and other shared services, like web application widgets, have the potential to quickly hit millions of users. My bet is that it is only a matter of time before we see many more similar incidents.

While there's never any good news in such breaches, it's promising DoubleClick, Microsoft, and AdShuffle (the legitimate one) were able to quickly clamp down on the attack.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6090
Published: 2015-04-27
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 6.0.3.0 iFix8, 6.0.4 before 6.0.4.5 iFix...

CVE-2014-6092
Published: 2015-04-27
IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5 before 6.0.5.6 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...

CVE-2015-0113
Published: 2015-04-27
The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...

CVE-2015-0174
Published: 2015-04-27
The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2015-0175
Published: 2015-04-27
IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.