Risk
12/11/2010
01:44 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Researchers: Major Ad Networks Serving Malware

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.Armorize chief technology officer Wayne Huang revealed in this blog post that two of the world's largest ad networks were actively serving malware and potentially infecting visitors to Web sites serving those ads. Millions of web users could had of been infected, Armorize CEO Caleb Sima told InformationWeek in an interview.

The payload in the attacks is a malicious program known as HDD Plus, which is a bogus system analysis and optimization program.

Armorize discovered the attacks on December 4 through its HackAlert offering. HackAlert is designed to identify Web sites and online advertisements infected with malware. The malware was served through JavaScript code transferred through online ads from DoubleClick, Sima said.

From their blog post on the attack:

Behavior: Users visit websites that incorporate banner ads from DoubleClick or rad.msn.com, the malicious javascript is served from ADShufffle.com (notice the three f's), starts a drive-by download process and if successful, HDD Plus and other malware are installed into the victim's machine, without having the need to trick the victim into doing anything or clicking on anything. Simply visiting the page infects the visitors.

Known sites affected: Sites that incorporate DoubleClick or rad.msn.com banners, including for example Scout.com (using DoubleClick), realestate.msn.com, msnbc.com (using both), and mail.live.com. We'd like to note here it's very possible that multiple exchanges, besides those listed here, have been serving the fake ADShufffle's ads.

Notice the three Fs in the name ADShufffle, it's a deft fake of the legitimate AdShuffle.

Here's a list of the exploits and malware used in the attack:

Initially with DoubleClick: 1) Internet Explorer iepeers (CVE-2010-0806)

Later with DoubleClick and rad.msn.com: 2) JDT: Java Web Start Arbitrary command-line injection (CVE-2010-0886) 3) Adobe Reader and Adobe Acrobat 9 GetIcon (CVE-2009-0927) 4) Microsoft MDAC RDS.Dataspace ActiveX (CVE-2006-0003) 5) Adobe Reader and Acrobat 9.x Doc.media.newPlayer () 6) Adobe Acrobat and Reader util.printf (CVE-2008-2992) 7) Adobe Reader GetMailInfo (CVE-2007-5659)

Malware installed: Over the past week, ADShufffle kept on changing the malware. Besides HDD Plus, other types of malware, such as backdoors, have been served. Later in the article we will provide links to our observed binaries.

Exploit packs used: Primarily a modified version of Eleonore. Neosploit was also used. With neosploit, malicious binaries are obfuscated on-the-fly before being served.

Not a trivial attack. And users who visited web sites serving the attack advertising were hit with the payload without having to click on anything; large web sites such as MSBC were affected; the exploits were well obfuscated; and according to Armorize, anti-virus vendors were very poor in initial detection rates.

Because these ads have the potential to be served to millions of web browsers, it's nearly impossible to determine how many people could have been infected. One thing that can be determined with more certainty: expect more of these kinds of attacks.

Such ad networks and other shared services, like web application widgets, have the potential to quickly hit millions of users. My bet is that it is only a matter of time before we see many more similar incidents.

While there's never any good news in such breaches, it's promising DoubleClick, Microsoft, and AdShuffle (the legitimate one) were able to quickly clamp down on the attack.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.