Risk
12/11/2010
01:44 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Researchers: Major Ad Networks Serving Malware

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.Armorize chief technology officer Wayne Huang revealed in this blog post that two of the world's largest ad networks were actively serving malware and potentially infecting visitors to Web sites serving those ads. Millions of web users could had of been infected, Armorize CEO Caleb Sima told InformationWeek in an interview.

The payload in the attacks is a malicious program known as HDD Plus, which is a bogus system analysis and optimization program.

Armorize discovered the attacks on December 4 through its HackAlert offering. HackAlert is designed to identify Web sites and online advertisements infected with malware. The malware was served through JavaScript code transferred through online ads from DoubleClick, Sima said.

From their blog post on the attack:

Behavior: Users visit websites that incorporate banner ads from DoubleClick or rad.msn.com, the malicious javascript is served from ADShufffle.com (notice the three f's), starts a drive-by download process and if successful, HDD Plus and other malware are installed into the victim's machine, without having the need to trick the victim into doing anything or clicking on anything. Simply visiting the page infects the visitors.

Known sites affected: Sites that incorporate DoubleClick or rad.msn.com banners, including for example Scout.com (using DoubleClick), realestate.msn.com, msnbc.com (using both), and mail.live.com. We'd like to note here it's very possible that multiple exchanges, besides those listed here, have been serving the fake ADShufffle's ads.

Notice the three Fs in the name ADShufffle, it's a deft fake of the legitimate AdShuffle.

Here's a list of the exploits and malware used in the attack:

Initially with DoubleClick: 1) Internet Explorer iepeers (CVE-2010-0806)

Later with DoubleClick and rad.msn.com: 2) JDT: Java Web Start Arbitrary command-line injection (CVE-2010-0886) 3) Adobe Reader and Adobe Acrobat 9 GetIcon (CVE-2009-0927) 4) Microsoft MDAC RDS.Dataspace ActiveX (CVE-2006-0003) 5) Adobe Reader and Acrobat 9.x Doc.media.newPlayer () 6) Adobe Acrobat and Reader util.printf (CVE-2008-2992) 7) Adobe Reader GetMailInfo (CVE-2007-5659)

Malware installed: Over the past week, ADShufffle kept on changing the malware. Besides HDD Plus, other types of malware, such as backdoors, have been served. Later in the article we will provide links to our observed binaries.

Exploit packs used: Primarily a modified version of Eleonore. Neosploit was also used. With neosploit, malicious binaries are obfuscated on-the-fly before being served.

Not a trivial attack. And users who visited web sites serving the attack advertising were hit with the payload without having to click on anything; large web sites such as MSBC were affected; the exploits were well obfuscated; and according to Armorize, anti-virus vendors were very poor in initial detection rates.

Because these ads have the potential to be served to millions of web browsers, it's nearly impossible to determine how many people could have been infected. One thing that can be determined with more certainty: expect more of these kinds of attacks.

Such ad networks and other shared services, like web application widgets, have the potential to quickly hit millions of users. My bet is that it is only a matter of time before we see many more similar incidents.

While there's never any good news in such breaches, it's promising DoubleClick, Microsoft, and AdShuffle (the legitimate one) were able to quickly clamp down on the attack.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0547
Published: 2015-07-04
The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0548
Published: 2015-07-04
The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0551
Published: 2015-07-04
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P2...

CVE-2015-1966
Published: 2015-07-04
Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafte...

CVE-2015-4196
Published: 2015-07-04
Platform Software before 4.4.5 in Cisco Unified Communications Domain Manager (CDM) 8.x has a hardcoded password for a privileged account, which allows remote attackers to obtain root access by leveraging knowledge of this password and entering it in an SSH session, aka Bug ID CSCuq45546.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report