Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/5/2020
04:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attackers Distributing Malware Under Guise of Security Certificate Updates

Approach is a twist to the old method of using fake software, browser updates, Kaspersky says.

Cybercriminals can be an innovative bunch when it comes to finding new ways to distribute malware.

The latest example is a new campaign involving the use of a fake digital certificate "update" to try and infect systems of visitors to previously compromised websites.

Security vendor Kaspersky on Thursday reported that its researchers had recently observed visitors to various websites being greeted with a warning about the site's security certificate having expired and being invited to download an updated one instead. Users who fell for the lure ended up downloading malware on their systems.

The campaign appears to have started around mid-January and impacted visitors to several websites, including one belonging to a zoo and another to an auto parts dealer. Kaspersky said it is not immediately clear how exactly the attackers behind the campaign might have initially infected these sites.

According to Kaspersky, the campaign is the first one its researchers have encountered where attackers are attempting to distribute malware in the guise of a website security update. The method is a slight twist on an approach that attackers have employed for a long time of hiding malware in fake software and browser updates and Adobe Flash installs. Attackers have planted such updates on legitimate sites and tried to trick users into downloading them under various pretexts — or they have tricked them to navigating to sites hosting the malicious updates.

"People are particularly susceptible to this type of attack because it appears on legitimate websites — ones they've possibly already visited," says Victoria Vlasova, a malware analyst at Kaspersky.

In the latest campaign, users to infected websites are greeted with a notification through an iframe about the site's security certificate being out of date. The contents of the iframe are from a third-party resource and are simply overlaid on top of the original page. As a result, the URL bar still displays the legitimate address of the compromised website, Kaspersky said in a report. The iframe overlay is also exactly the same size as the page so users wouldn't have an easy way to proceed to the site if they chose to ignore the fake notification.

Because the address listed in the iframe is, in fact, the real address of the website, the natural instinct for users is to install the recommended certificate so they can view the content they want to, Vlasova says. "However, users should always be wary when prompted to download something by an online source," she adds. "Chances are, it's not necessary.”

Campaign Being Used to Distribute Mokes & Buerak Malware
In the new campaign that Kaspersky observed, attackers are distributing Mokes and Buerak, two previously known pieces of malware, under the guise of a security certificate update.

Mokes is a backdoor from several years ago that can be used to download other malware, steal credentials, and intercept data that users might enter into a Web form. The malware, referred to by some as "Smoke Loader," can also be used to install shell code on an infected computer, according to Kaspersky. Buerak has similar functionality and can be used to spread other malware, including crypto-mining software, ransomware, remote access Trojans, and keyloggers.

"As incidents involving certificate issuance and deployment become more well-known and mainstream, attackers have one more avenue to use in creating attacks that leverage social engineering efforts" said Pratik Savla, senior security engineer at Venafi. "Unfortunately, and also unsurprisingly, we are bound to see an uptick of this kind of campaign."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "The Perfect Travel Security Policy for a Globe-Trotting Laptop."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14499
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
CVE-2020-14501
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also ...
CVE-2020-14503
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
CVE-2020-14497
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
CVE-2020-14505
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection�) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that create...