16 ms·
An exploit kit hiding in the pixels of malicious ads
- eps 10y agoThey pack malware code into an alpha channel of the ad image and then use inoccuous looking JS code (which happens to be delivered with the ad) to extract and execute it. This allows them to sneak their goods past the ad network review. Neat, but not that impressive.
- Animats 10y agoThe real attack is via Adobe Flash. The image thing is only to get past some virus scanners. There have been so many vulnerabilities in Adobe Flash one has to wonder if they're deliberate. It's not a large body of code, after all.
- mschuster91 10y ago> It's not a large body of code, after all. Oh, of course it is. A complete scripting runtime engine (ActionScript), support for a boatload of video streaming formats including realtime communication, ...
- laurent123456 10y agoAnd rather advanced 2D and 3D rendering engines.
- Animats 10y agoIt once all fit in a 1MB executable, and it hasn't gained much functionality since then.
- mschuster91 10y agoOne might say the same thing about browsers - as Flash bloated in scope over time, so do browsers now. Firefox clocks in at a healthy ~50 MB, as does Google Chrome, for the offline installers - Chrome expands to ~360MB app size, and Firefox to ~180MB (both current versions on OS X 10.11). I won't even get started on the RAM usage - a typical 10-tab session can easily munch happily through 4 GB RAM and more (especially when there are lots of ads). It's a pity that a 3-year-old netbook (or cellphone) is basically unusable because browsers creep up so much in featuritis :(
- Steeeve 10y agoThrow in security updates twice a week for years on end... Thank goodness that nightmare is over.
- aikah 10y ago> It's not a large body of code, after all. The Flash runtime is big, the API surface is huge and Adobe doesn't feel like it pours a lot of resources into maintenance today. The tech was nice but it should be banned from browsers today.
- hood_syntax 10y agoI'd certainly appreciate that. At least Twitch has an HTML5 player now, that cuts out a major use case for me.
- MaBu 10y agoBut how can attack over Adobe Flash still works when Flash is disabled by default on FF and Chrome?
- skuzye 10y agothis particular attack targets IE users
- forrestthewoods 10y agoMoral of the Story: There's no such thing as an innocuous eval()?
- _nalply 10y agoI use PHP's eval() for an interactive testing environment on a live smallish server. It's like open-heart surgery, so I agree it's not innocuous. Of course I took care to protect the access. This environment is useful for some quick hacks and tests. If this were a bigger deployment with more at stake, I would remove this environment from the production systems. Because, you know, it's not innocuous.
- gurgus 10y agoThis isn't a useful answer for you at all, but I thought I'd mention that there are "kind of" innocuous eval()'s such as Angular's eval() [1] where instead of JS being evaluated (which can lead to nasty things), an Angular expression is evaluated, which is a bit safer. Obviously what I've just said doesn't help solve any problems here, but thought I'd throw it in there anyway :) [1] https://docs.angularjs.org/api/ng/type/$rootScope.Scope#$eval https://docs.angularjs.org/api/ng/type/$rootScope.Scope#$eva...
- 234dd57d2c8db 10y agoThis is false, Angular expressions / sandbox are NOT security. They are not safer at all. Do not execute untrusted Angular expressions.
- shakna 10y agoUnless the language supports first class environments, and you're binding to that. (Like Common LISP, Scheme, Lua, ...)
- penguat 10y agoAnd it needn't look like eval: http://www.jsfuck.com http://www.jsfuck.com
- alkonaut 10y agoWait, why don't they just ship the evil code right away? If some blocking routine would be able to detect the malicios code as-is, shouldn't it be able to detect this as malicious code? It's code that builds javascript code and evals() it! You shouldn't need any kind of blocking for that, the browser should block it out of the box.
- Drakim 10y agoYeah, it seems like treating eval() as acceptable would allow for many other less elaborate nasty things. I mean, couldn't you just do eval('edoc dab'.split().reverse().join())?
- zamalek 10y agoReviewers are probably taught what to look out for. In this case, training is the vulnerability.
- alkonaut 10y agoYou mean people at the ad-networks, reviewing the code that advertisers want to use? Seems like a single occurrence of "eval" should both fail that automatic review AND be blocked by default in all browsers using default security settings. I think this just shows that ad networks shouldn't be using js at all. Just dumb images. (Yes I know, no tracking then which makes it useless yada yada - deal with it)
- zamalek 10y ago> Seems like a single occurrence of "eval" should both fail that automatic review You're not wrong, but there are difficult customers with money to consider.
- alkonaut 10y ago> You're not wrong, but there are difficult customers with money to consider. In google's case I can see the conflict - they both make a browser and live off ads. But apart from that minor issue I don't see why browser vendors don't just block "eval()"? (Also, they have started blocking flash, thank god - so maybe this will all be a thing of the past soon)
- userbinator 10y agoJavaScript demos have been using a similar trick for several years. https://news.ycombinator.com/item?id=9319526 https://news.ycombinator.com/item?id=9319526
- AlphaWeaver 10y agoI find the impressive part the stenography they did to make sure that the code wasn't being monitored in a security researcher's sandbox.
- imglorp 10y agoThis also sneaks past CORS. I'm thinking _that's_ a problem.
- iancarroll 10y agoWhy do you think this bypasses CORS?
- imglorp 10y agoWell, it bypasses the spirit, which was to exert some control over what got loaded into the browser via the back door. Now, malicious code can just come in the front door.
- RodgerTheGreat 10y agoIf anything it's a useful demonstration of how CORS is more theater than security for anything beyond the most trivial scenarios.
- moosingin3space 10y agoI wonder how hard it would be to come up with a "containerization" mechanism for the web so as to separate scripts/resources better.
- deleted 10y ago[deleted]
- gurneyHaleck 10y agoSo much for CORS policies. If browsers restricted cross-origin sharing of image resources to same domain only, bazillions of dollars in tracking pixel revenue would evaporate. Deep inspection of image rasters by script execution isn't going to get locked down anytime soon, I surmise.
- vortico 10y agoActually this is a good idea. Is there a way to make Firefox behave like this? I'm interested how broken the web would become, or if it would actually make the web faster and more usable by only loading content relevant to the website.
- shakna 10y agoMy guess would be a lot, with s3 providing so much of static content, or via 3rd party CDNs.
- mtgx 10y agoMore or less than if browsers had blocked Flash say 3 years ago? Because I think that's the standard. If they can do it for Flash, then they can do it for anything else, too. They just need to set a deadline with a reasonable amount of time before it's reached so that all developers can adhere to the new specs. I really hate the attitude of "well, too many websites/apps would be broken so I guess we'll never do it, or we'll just wait for the web to collapse first so that everyone agrees we should do it" from "platform" (in this case browser) vendors. If it's that bad, then just set a 2 year, 3 year, or even 5 year deadline for the change (perhaps with some intermediary progressive blocking, like it's happening for Flash). It pisses me off because it seems the same is happening with ASLR on Linux [1]. We've had it for 15 years, but nobody is willing to force developers to use it "because it would break things". Screw that. Set a deadline and do it already. If their apps can't make such a change in 3 years, then I could care less that their apps will stop working. Critical vulnerabilities that allow dangerous exploits to happen also "break a lot of things", and not just themselves either, but the firefighting patches that come after them, too. [1] https://lwn.net/SubscriberLink/708196/845f9287f1936dcf/ https://lwn.net/SubscriberLink/708196/845f9287f1936dcf/
- Splines 10y ago> It is particularly interested in presence software containing the following strings in their filenames: Makes me wonder if there is a benefit in making a real machine appear to be a VM (or even if its possible).
- matheusmoreira 10y agoAds turned into stegotext carrying an exploit as payload? Yet another reason to block them.
- matt_wulfeck 10y agoI really don't want to block all ads. I want companies to earn revenue from their readers. But this has to stop if I'm ever going to surf the net unprotected.
- a3n 10y agoYeah, I'd like to receive ads and help the sites I use stay in business. But that industry as a whole is going to have to lock this down before I'll unblock.
- godmodus 10y agoThe nature of people && the Internet && geopolitics && the economy will never allow this within our time. Never surf unprotected. Hell our current protection is lacking and needs further fortification. Edit: I also think ads are a bad source of income. It's based in psych warfare and in turn is based on toxic adversarial culture.
- wcummings 10y agoAds are as old as media, better get used to it.
- wu-ikkyu 10y agoAd blockers are new, so we don't have to "get used to it". Successfully lowering the amount of incessant ads I am exposed to has increased my sovereignty and peace of mind.
- jamespo 10y agoFeel free to welcome your new "sponsored content" overlords
- CaptSpify 10y agoI never understood this argument. It's not like advertisers are going to say "Oh, everyone is unblocking ads. Let's stop using 'sponsored content' then!" They are going to continue with both sponsored content AND ads. I'm just cutting off one side.
- mixedbit 10y agoIf the attacker fully controls the decoding JavaScript, I don't get why the exploit is encoded in the banner and not directly included in JavaScript?
- aikah 10y agoAnd then networks and publishers complain about users blocking ads. That's why people should block ads served by third parties. It's not just about visual nuisance but security first and foremost.
- unabridged 10y agoI have to see warnings for weak certificates, but loading 3rd party scripts is ok by default. When browsers are written by ad companies or beholden to ad companies, this is what you get. Apple and Firefox (if Yahoo will let them) need to step up and block 3rd party scripts by default. Maybe even Chrome would get in on it if there was special whitelisting for Google's analytics.
- TeMPOraL 10y agoThat would kill 90% of the web, because people love to load Bootstrap, jQuery and Google ajax crap from 3rd party CDNs. Can we just please get content-based hashing and stop with this JS outsourcing bullshit?
- jdavis703 10y agoEven places that aren't loading crap from 3rd party CDNs put their bundled JS code onto their own CDN that probably has a different origin than the site you're on.
- Klathmon 10y agoContent based caching would be a massive security nightmare. All you'd need to do is serve up the same asset as any other site on the web and you could instantly know if the user has been there recently. No need for tracking at all, just serve this up to people who go to HN, this to the redditors, this to anyone that was recently on 4chan... Or let's take it a step further. I could reasonably figure out what your user-page on HN looks like to you when you're logged in. I'll serve that up to all my visitors and when I get a cache-hit I know it's you!
- EJTH 10y agoWhen will people just learn to disable flash on their browsers?
- laurent123456 10y agoThe other day there was this article claiming that virus scanners do more harm than good, but in this particular case it's interesting to see that they would have prevented the exploit.
- singularity2001 10y ago"If it detects anything suspicious, it will not attempt to download the payload. ( kasper, avast, f-secu*, wireshark.exe, ollydbg.exe ...)" wireshark as antivir ... nice to have ;)
- Exuma 10y agoI love how it discards 42 bytes of the beginning of the image... the answer to the meaning of life :D
- mdrzn 10y ago> Using the known Internet Explorer vulnerability CVE-2016-0162, the encoded script attempts to verify that it is not being run in a monitored environment such as a malware analyst’s machine. So this would work only on Internet Explorer?
- MoOmer 10y agoNo, the paranoid developers wanted to use that exploit to check if it was on an analyst's machine. That's an imposed restriction, not an inherent constraint.
- peteretep 10y agoWonder how long until corporate IT policies mandate the use of adblockers
- LDM 10y agoIf you're an engineer and are fascinated by this subject, I'm interested to hear from you. Our startup specializes in the real time detection and blocking of these malicious ads. Contact details in my bio.
- codeddesign 10y agoThis is an ad server though right? Or are you able to monitor 3rd party providers?
- ommunist 10y agoThis is incredible piece of IT. Interesting, which ad networks are used?
- amenod 10y agoI am not quite sure how they got to running JS on victim's browser in the first place? I would guess any JS being loaded is from ad network. I know IE had this vulnerability where it would ignore MIME type and would guess file type from content (so attacker could server a specially crafted image which would be interpreted as JS), but that should be long patched... Or did they act as an ad network themselves?
- detaro 10y ago(at least most) Ad networks deliver JS provided by the advertiser as well.
- pm24601 10y agoSo the simplest way to avoid getting exploited is to always run wireshark? Sounds better than an out of date AV solution! (and cheaper)