Risk
12/11/2010
01:44 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Researchers: Major Ad Networks Serving Malware

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.

Researchers at web security firm Armorize Technologies recently discovered that DoubleClick and Microsoft ad networks were serving (for a brief time) a banner ad tainted with malware. The attack could had of impacted millions, the researchers day.Armorize chief technology officer Wayne Huang revealed in this blog post that two of the world's largest ad networks were actively serving malware and potentially infecting visitors to Web sites serving those ads. Millions of web users could had of been infected, Armorize CEO Caleb Sima told InformationWeek in an interview.

The payload in the attacks is a malicious program known as HDD Plus, which is a bogus system analysis and optimization program.

Armorize discovered the attacks on December 4 through its HackAlert offering. HackAlert is designed to identify Web sites and online advertisements infected with malware. The malware was served through JavaScript code transferred through online ads from DoubleClick, Sima said.

From their blog post on the attack:

Behavior: Users visit websites that incorporate banner ads from DoubleClick or rad.msn.com, the malicious javascript is served from ADShufffle.com (notice the three f's), starts a drive-by download process and if successful, HDD Plus and other malware are installed into the victim's machine, without having the need to trick the victim into doing anything or clicking on anything. Simply visiting the page infects the visitors.

Known sites affected: Sites that incorporate DoubleClick or rad.msn.com banners, including for example Scout.com (using DoubleClick), realestate.msn.com, msnbc.com (using both), and mail.live.com. We'd like to note here it's very possible that multiple exchanges, besides those listed here, have been serving the fake ADShufffle's ads.

Notice the three Fs in the name ADShufffle, it's a deft fake of the legitimate AdShuffle.

Here's a list of the exploits and malware used in the attack:

Initially with DoubleClick: 1) Internet Explorer iepeers (CVE-2010-0806)

Later with DoubleClick and rad.msn.com: 2) JDT: Java Web Start Arbitrary command-line injection (CVE-2010-0886) 3) Adobe Reader and Adobe Acrobat 9 GetIcon (CVE-2009-0927) 4) Microsoft MDAC RDS.Dataspace ActiveX (CVE-2006-0003) 5) Adobe Reader and Acrobat 9.x Doc.media.newPlayer () 6) Adobe Acrobat and Reader util.printf (CVE-2008-2992) 7) Adobe Reader GetMailInfo (CVE-2007-5659)

Malware installed: Over the past week, ADShufffle kept on changing the malware. Besides HDD Plus, other types of malware, such as backdoors, have been served. Later in the article we will provide links to our observed binaries.

Exploit packs used: Primarily a modified version of Eleonore. Neosploit was also used. With neosploit, malicious binaries are obfuscated on-the-fly before being served.

Not a trivial attack. And users who visited web sites serving the attack advertising were hit with the payload without having to click on anything; large web sites such as MSBC were affected; the exploits were well obfuscated; and according to Armorize, anti-virus vendors were very poor in initial detection rates.

Because these ads have the potential to be served to millions of web browsers, it's nearly impossible to determine how many people could have been infected. One thing that can be determined with more certainty: expect more of these kinds of attacks.

Such ad networks and other shared services, like web application widgets, have the potential to quickly hit millions of users. My bet is that it is only a matter of time before we see many more similar incidents.

While there's never any good news in such breaches, it's promising DoubleClick, Microsoft, and AdShuffle (the legitimate one) were able to quickly clamp down on the attack.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.