Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/5/2020
04:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attackers Distributing Malware Under Guise of Security Certificate Updates

Approach is a twist to the old method of using fake software, browser updates, Kaspersky says.

Cybercriminals can be an innovative bunch when it comes to finding new ways to distribute malware.

The latest example is a new campaign involving the use of a fake digital certificate "update" to try and infect systems of visitors to previously compromised websites.

Security vendor Kaspersky on Thursday reported that its researchers had recently observed visitors to various websites being greeted with a warning about the site's security certificate having expired and being invited to download an updated one instead. Users who fell for the lure ended up downloading malware on their systems.

The campaign appears to have started around mid-January and impacted visitors to several websites, including one belonging to a zoo and another to an auto parts dealer. Kaspersky said it is not immediately clear how exactly the attackers behind the campaign might have initially infected these sites.

According to Kaspersky, the campaign is the first one its researchers have encountered where attackers are attempting to distribute malware in the guise of a website security update. The method is a slight twist on an approach that attackers have employed for a long time of hiding malware in fake software and browser updates and Adobe Flash installs. Attackers have planted such updates on legitimate sites and tried to trick users into downloading them under various pretexts — or they have tricked them to navigating to sites hosting the malicious updates.

"People are particularly susceptible to this type of attack because it appears on legitimate websites — ones they've possibly already visited," says Victoria Vlasova, a malware analyst at Kaspersky.

In the latest campaign, users to infected websites are greeted with a notification through an iframe about the site's security certificate being out of date. The contents of the iframe are from a third-party resource and are simply overlaid on top of the original page. As a result, the URL bar still displays the legitimate address of the compromised website, Kaspersky said in a report. The iframe overlay is also exactly the same size as the page so users wouldn't have an easy way to proceed to the site if they chose to ignore the fake notification.

Because the address listed in the iframe is, in fact, the real address of the website, the natural instinct for users is to install the recommended certificate so they can view the content they want to, Vlasova says. "However, users should always be wary when prompted to download something by an online source," she adds. "Chances are, it's not necessary.”

Campaign Being Used to Distribute Mokes & Buerak Malware
In the new campaign that Kaspersky observed, attackers are distributing Mokes and Buerak, two previously known pieces of malware, under the guise of a security certificate update.

Mokes is a backdoor from several years ago that can be used to download other malware, steal credentials, and intercept data that users might enter into a Web form. The malware, referred to by some as "Smoke Loader," can also be used to install shell code on an infected computer, according to Kaspersky. Buerak has similar functionality and can be used to spread other malware, including crypto-mining software, ransomware, remote access Trojans, and keyloggers.

"As incidents involving certificate issuance and deployment become more well-known and mainstream, attackers have one more avenue to use in creating attacks that leverage social engineering efforts" said Pratik Savla, senior security engineer at Venafi. "Unfortunately, and also unsurprisingly, we are bound to see an uptick of this kind of campaign."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "The Perfect Travel Security Policy for a Globe-Trotting Laptop."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8004
PUBLISHED: 2020-04-06
STMicroelectronics STM32F1 devices have Incorrect Access Control.
CVE-2020-7631
PUBLISHED: 2020-04-06
diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
CVE-2020-7632
PUBLISHED: 2020-04-06
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
CVE-2020-7633
PUBLISHED: 2020-04-06
apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument.
CVE-2020-7634
PUBLISHED: 2020-04-06
heroku-addonpool through 0.1.15 is vulnerable to Command Injection.