Slashdot Mirror
New Stegano Exploit Kit Hides Malvertising Code In Banner Pixels (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: For the past two months, a new exploit kit has been serving malicious code hidden in the pixels of banner ads via a malvertising campaign that has been active on several high profile websites. Discovered by security researchers from ESET, this new exploit kit is named Stegano, from the word steganography, which is a technique of hiding content inside other files. In this particular scenario, malvertising campaign operators hid malicious code inside PNG images used for banner ads. The crooks took a PNG image and altered the transparency value of several pixels. They then packed the modified image as an ad, for which they bought ad displays on several high-profile websites. Since a large number of advertising networks allow advertisers to deliver JavaScript code with their ads, the crooks also included JS code that would parse the image, extract the pixel transparency values, and using a mathematical formula, convert those values into a character. Since images have millions of pixels, crooks had all the space they needed to pack malicious code inside a PNG photo. When extracted, this malicious code would redirect the user to an intermediary ULR, called gate, where the host server would filter users. This server would only accept connections from Internet Explorer users. The reason is that the gate would exploit the CVE-2016-0162 vulnerability that allowed the crooks to determine if the connection came from a real user or a reverse analysis system employed by security researchers. Additionally, this IE exploit also allowed the gate server to detect the presence of antivirus software. In this case, the server would drop the connection just to avoid exposing its infrastructure and trigger a warning that would alert both the user and the security firm. If the gate server deemed the target valuable, then it would redirect the user to the final stage, which was the exploit kit itself, hosted on another URL. The Stegano exploit kit would use three Adobe Flash vulnerabilities (CVE-2015-8651, CVE-2016-1019 or CVE-2016-4117) to attack the user's PC, and forcibly download and launch into execution various strains of malware.
Not no, hell no.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
If you block the ad, you're a thief.
“He’s not deformed, he’s just drunk!”
I'm going to much more efficient. "Avoid the middleman! Download this malware, straight from me to you!"
All the more reason to use an ad blocker extension. Let the e-beggar sites that pester you about having an ad blocker know why you do. Maybe they'll finally get a clue and shut down or find a legitimate way to make money.
First of all, Jesus H. Chist, I'm continually amazed at the lengths people will go and the sheer brainpower employed in malware and hacking generally. I've gotten to the point where I go to hang a towel over the mirror in the bathroom because I'm worried someone has hacked the mirror and then figure, fuck it, they probably also hacked the towel.
Secondly, is this level of malware sophistication evidence that there's economic stagnation?
I'm assuming this is software designed to create botnets or measly bank account info or whatnot and the author(s) make some money but not griping about the lack of space for their megayacht next season at Monaco kinds of money.
Is the fact that people do this kind of really clever shit for more or less ordinary income, is it proof that the economy is in some way broken? I would think that people this smart, in a functional economy, would be in real demand to do productive economy kinds of things.
Banner ads are still a thing? I haven't seen one in years. Guess those ad blockers are paying off.
A question to the readers: I've been trying to view this online comic for awhile now.
The problem is, the comic itself is written in Flash, and I can't think of any way to enable flash without downloading all the Adobe crap, or installing a browser extension that's horribly unsafe to use. My best guess is to do all this in a separate VM specifically tuned to do this one task, and then delete it when done.
Make an entire system specific to reading one website? That seems like a lot of work.
Is there some sort of offline viewer I can use, or convert the files to PDF or something?
Is this work of art now forever lost because the means to display it is gone?
Not really an issue for me as this one of the reasons I use an ad blocker. The part I found mind boggling is "a large number of advertising networks allow advertisers to deliver JavaScript code with their ads". That is just plain wrong. How can any website sell advertising with a clear conscious if they are going to allow effectively unknown people to run code on their visitor's PCs?
For all reasons mentioned and past exploits I can see cruising the internet through a VM becoming very popular. Especially since some new NAS are coming with the ability to run a VM.
Shai Schticks:"You don't make peace with friends, you make peace with enemies"
First of all, Jesus H. Chist, I'm continually amazed at the lengths people will go and the sheer brainpower employed in malware and hacking generally. I've gotten to the point where I go to hang a towel over the mirror in the bathroom because I'm worried someone has hacked the mirror and then figure, fuck it, they probably also hacked the towel.
Thanks for that laugh. The analogy was rather hilarious. Now I think I'll have a good cry over the reality of it.
Secondly, is this level of malware sophistication evidence that there's economic stagnation?...Is the fact that people do this kind of really clever shit for more or less ordinary income, is it proof that the economy is in some way broken?
Yes, perhaps it is. Another example would be the evolution of ransomware. Started out as a rather brilliant idea from a hacking standpoint to extort humans for more or less ordinary income.
I would think that people this smart, in a functional economy, would be in real demand to do productive economy kinds of things.
Across history, countless times we've caught ourselves laughing at how much more con artists could earn by walking the legal line instead of the life of crime. That said, this economy rewards the world's greatest narcissists who do little more than generate clicks. Is this economy broken? Fuck yes it is. In more ways than one.
And this isn't illegal?
Is BleepingComputer the latest Medium.com? Because it seems like every time I come to Slashdot there's yet another story from that site...
#DeleteChrome
The summary was missing details, but this link explains a bit more.
http://www.welivesecurity.com/...
At least you'll know how it works. Also, go down to the list and see if you have at least one of those security products and it'll skip the payload. :)
...reading at, "This server would only accept connections from Internet Explorer users." Now feeling smug.
If you can't communicate your ad with a static image, a video
A scripted vector animation has a smaller file size (and thus costs you less to view in overage fees payable to your ISP) than the equivalent H.264 or VP8 video. But I don't see how a scripted vector animation of considerable complexity can be done with CSS transitions alone. It's usually script writing to a canvas or script manipulating CSS element styles or SVG paths.
a large number of advertising networks allow advertisers to deliver JavaScript code with their ads
Third-party code. 'Nuff said.
Secondly, is this level of malware sophistication evidence that there's economic stagnation?
I'm assuming this is software designed to create botnets or measly bank account info or whatnot and the author(s) make some money but not griping about the lack of space for their megayacht next season at Monaco kinds of money.
Is the fact that people do this kind of really clever shit for more or less ordinary income, is it proof that the economy is in some way broken? I would think that people this smart, in a functional economy, would be in real demand to do productive economy kinds of things.
A problem solved by software can often be copied for essentially zero. The initial cost may be relatively high, but let's say ordinary salary numbers, particularly in foreign countries, so what in the $30k range... If they can infect say 30k computers say 4 times a year. The computers could easily be different... That yields needing to make roughly, on average, $0.25 a computer. There is a lot of hand waving there, but I assume most of it is purely the economies of scale. Also, once a vulnerability is in the wild, it is no doubt easier to copy it than try to find your own.
Now once you compromise a PC, getting it to effectively just view and click on links for money is likely achievable. Remember you need to make like 25 cents per computer per year... There is also more direct options like scamming bank account info, holding data hostage, etc..
See subject: A list of specific hosts from ESET's research to enter into your custom hosts file to protect vs. Stegano:
0.0.0.0 browser-defence.com
0.0.0.0 broxu.com
0.0.0.0 conce.republicoftaste.com
0.0.0.0 compe.quincephotographyvideo.com
0.0.0.0 ntion.atheist-tees.com
0.0.0.0 entat.usedmachinetools.co
0.0.0.0 connt.modusinrebus.net
0.0.0.0 ainab.photographyquincemiami.com
0.0.0.0 rated.republicoftaste.com
0.0.0.0 rence.backstageteeshirts.com
FROM http://www.welivesecurity.com/...
APK
P.S.=> All I can say to ESET is "Good job guys, & Thank you - keep up the good work!"... apk
Interesting point of view. It might also be proof that software quality has improved a lot, and there aren't so many 'normal' holes to drive through anymore...
Not likely:
a) At best, you've just moved the problem to securing the host system. Which if you're running a bare metal VM like ESXi or Hyper-V is certainly easier than securing an entire OS that needs to explicitly allow userland programs to do arbitrary things. But its not a null issue.
b) VMs would need to become far, far less annoying to use. Basically until such time that OS's do something like load every single app into its own sandbox, invisible to the user, this won't happen on any sort of large scale. Including somehow securely sharing data between sandboxes (so for example your video player could play the movie you downloaded from your browser) and again with little to no user hassle.
c) Even given all of that, it still has the issue of persistent data. If the VM's data persists inside the VM, then its got the potential to be compromised at least within the sandbox and since most people only use a small number of apps, having one of them lose all data is still a serious issue. And if its persisted outside the sandbox (as in the shared data issue above) then its potentially compromising the entire system and we're back to square one.
Modern browsers and Flash Player and Java and whatnot all do their best to sandbox anything coming from the web already. I don't really see how moving up one step to a virtual machine will really do a whole lot better -- at least not without simultaneously introducing user experience issues that would make the setup untenable for average non-techie users.
Fine the ad creator. Can't find him? Fine the ad provider. Can't find him? Fine the owner of the site itself.
I want fines and I want jail time for malvertising. Heads must roll. This has gone on long enough.
Malware nowadays is not written by some script kiddie in his parent's basement. Malware creation is funded by crime rings in third-world countries who employ developers to analyze known exploits and code-hiding techniques, and hence the malware attacks are very sophisticated. This is what I say to various relatives who come and say their computer "is so slow it must have a virus". Modern malware tries to be as stealthy as possible, so slowing down your PC is the last thing they want to do. But that Avast hog you have (instead of a much lighter antivirus) and your never-defragged harddisk does make your computer slower. PS: Does Google ads filter the malicious JS code?
I don't think the economy is broken, well, it might be but even if it were 100% healthy, we'd still have these people. Mostly, they are people who do not fit into companies working for someone else. They are freelancers. They do not have what it takes to start their own legitimate company. In the past, we'd call them pickpockets or snake oil salesmen or in some cases, politicians. The intertubes are just vehicles for them. If they weren't doing it there, they'd find some other form of criminal vice. Their lives are built around leeching. The medium is secondary.
"This server would only accept connections from Internet Explorer users. The reason is that the gate would exploit the CVE-2016-0162 vulnerability that allowed the crooks to determine if the connection came from a real user or a reverse analysis system employed by security researchers."
The reason it only targets Internet Explorer is that the exploit only works on Microsoft windows.
And that technique can go way further.
https://www.youtube.com/watch?...
Atari rules... ermm... ruled.
Miranda
does it work on linux or android.
does it protect lynx.
If not, then not interested.
so thats a no then....
ok, ill stick with mvps.org then.
I get that we'd always have people at the margin who have above average intelligence but otherwise to fit into a worker mold and wind up as criminals of varying levels of success. Usually, though, they seem to suffer from various other pathologies -- substance abuse, psychological defects, the kind of panoply of sociological misintegration that limits not only their legitimate success but their ability to make even life below the line very successful.
Maybe there's just a correlation between high levels of computer skills and these same sociological maladjustments, and the medium provides an outlet previously unavailable which offers reduced risk and greater rates of success.
you obviously know nothing about android. you can only change the hosts file on a rooted android phone. which is basically a compromised phone before you even start.
a rooted phone is gauranteed to send all your private data to a malicious ip address, wont even use a dns lookup. whats the point in changing the hosts file on a device already hard coded to send everything on the device to the bad guys. why are you recommending android users compromise their device?
this isnt true any more. i had several malvertisers try and push an install of an unknown rpm through chrome before i added the winhelp mvps hosts file to the system. If id been using something like ubuntu instead of an otherwise hardened system they would quite possibly have been successful.
Is the fact that people do this kind of really clever shit for more or less ordinary income, is it proof that the economy is in some way broken?
The economy undoubtedly is broken in many ways, but I think exploits like this are less about the economy and more about programmers getting bored and wanting to show off how clever they are; and if they can also make some money doing it, so much the better.
I don't care if it's 90,000 hectares. That lake was not my doing.
Hiding the data in a seemingly innocent photo and unpacking it with a seemingly innocent parser makes it a lot harder to statically detect and filter on the way in.
Microsoft's Virtual PC gave us "B" before they abandoned the whole idea in favor of Hyper-V. As for "C" people already intentionally lose date through things like FF's "incognito" mode. The stuff they want to keep usually ends up in the cloud anyway where stronger security measures can be applied.
Shai Schticks:"You don't make peace with friends, you make peace with enemies"
PS: Does Google ads filter the malicious JS code?
Doubtful. the code was only the key and transform function, the payload was the transparency data of the image its self.
I'm sure they're going to start blocking it now, but there is no way they would have caught this in a normal screening.
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
What a terrible argument. If your code is so good, just open-source it and stop using the "everybody uses it so it's good" fallacy. Everybody uses windows.
Well, I guess you only need to fool the dumbest people ...
You could try to be more transparent and stand by the software you're peddling by being open, upfront, and honest instead of posting as AC to shill your software. I wouldn't trust you. I would trust something like Pi-hole though precisely because it is open and transparent; and, presumably does the same thing.
My guess is that most of these scams bring in revenue in the 1000's or tens of 1000's so certainly well below the "griping about the lack of space for their megayacht next season at Monaco". But remember that in some parts of the world, coding is cheap and what we might think of as a low income wage goes a long way.
Virtual PC gave us "B"
I don't recall that being significantly easier to setup than say VMWare Player. Perhaps a bit better but you still had to do things like install your guest OS, configure hardware devices and so on. Definitely not simple enough to be considered invisible to the user.
XP Mode was getting closer from that aspect.. if running Word or IE just magically loaded into a sandbox then we'd be getting closer to what I'm referring to, though that's got all of its own challenges as noted.
people already intentionally lose date through things like FF's "incognito" mode
Some people do. For some specific tasks that they want to hide from their families/coworkers/etc. A quick search suggests that its perhaps more people than I would have thought, though the stats I found didn't break down how much normal browsing the incognito users also did.
That said, browsing cookies and cache and history is a far cry different from say, Word documents. Sure cloud storage is a thing now and that's great (well.. as long as you don't care about MS or Google or whoever having access to your documents.) But it doesn't cover everything, introduces a bandwidth cost and generally tends to be less convenient in its own right with the exception of a few specifically designed cloud-based apps like Google Docs.
I'm not saying it can't be done or shouldn't be attempted.. just that its not really anywhere close at the moment. People value convenience over the chance of getting hacked (which is still relatively low for any specific individual -- a huge botnet with 10 million nodes is still a fraction of all the billions of computers on the planet.) Its high enough that we'll probably all know someone who loses a bunch of shit to a virus or whatever at some point, but not really so high that its worth spending huge amounts of additional time and energy doing computer gymnastics -- especially for those who aren't so good with computers and technology at the best of times.
Ubuntu asks for your password before installing a .deb from a link. If you're browsing as root or willy nilly type your password in whenever a box pops up asking you for it, then you deserved any and all malware you get.
--- Keep the choice with the user..
not afaik.
sudo still installs stuff as root, installing a malicious rpm will give that rpm, even by sudo, access to the entire system.
You really cant "harden" any of the old versions of windows though (thousands of zero days knocking around for what are now unsupported systems), and stuff written from earlier than 2007 doesn't really apply to any of the new versions of windows.
While a solid host file is essential (and as you say, there are lots of free ones around now), it wont protect you from material served from hijacked dns, which is fairly common practice now.
So when your DNS gets hijacked, every single person using your program gets hijacked to?
Wow. That's inviting a very big law suit.
Or you just cache the users repsonses? in which case, hijacked once, hijacked forever?
You think I'd be willing to share my zero days?
heh, interesting.....
how much you paying?
zero days are valuable you know...
or is your "fair challenge" not really that fair.
cos I'll take cash over ego or your appreciation any day of the week.
ill put up if you put up.
zero days typically fetch at least $10,000.
why should i waste that on you?
Id never get my ppl that way it seams.