Malware Dodges Scanners

Tuesday, April 10, 2012 @ 02:04 PM gHale

New Web-based malware attacks evade URL security scanners by checking for the presence of mouse cursor movement, researchers said.

The new drive-by download attacks are in the Russian Web space and don’t require user interaction to infect computers with malware, said security researchers from antivirus vendor ESET.

Security Firm Finds Attack Signs
Tool Automates an Attack
Malware’s Next Move: DNS
Watch Out for Malicious Proxies

Most attacks of this type rely on hidden iframes injected into legitimate, but compromised websites, to redirect their visitors to the actual attack page. However the websites affected by this new campaign don’t exhibit such rogue elements.

Instead, rogue JavaScript code adds to local JS files that load in the “head” section of every HTML page, making the infection harder to spot, the ESET security researchers said. Loading JavaScript in this way is a very common practice and is not particularly indicative of a compromise.

The code injected into these local JavaScript files loads a different JS file from an external location, but only if it detects mouse cursor movement on the page. The purpose of the mouse movement detection is to filter out URL scanners and Web crawlers used by security companies or search engines to detect infected websites.

It is a simple technique, but it suggests that cyber criminals are looking for more proactive ways to differentiate between human visitors and automated bots, so they can keep their attacks undetected for longer periods of time, the ESET researchers said. “It’s a natural evolution for drive-by download attacks to include malicious code employing proactive techniques for detecting real user activity and bypassing malware collecting systems.”

If the check determines the request came from a human, the external JavaScript code injects an iframe into the original HTML page on the fly, which then loads attack code from an installation of the Nuclear Pack exploit toolkit.

Like most drive-by download attack tools, Nuclear Pack attempts to exploit remote code execution vulnerabilities in unpatched versions of browser plug-ins such as Java, Adobe Reader or Flash Player, in order to infect victims’ computers with malware.

In this case, the Nuclear Pack installation attempts to exploit the CVE-2012-0507 Java vulnerability, patched in Java for Windows back in February and in Java for Mac last week, as well as a much older vulnerability in Adobe Reader, identified as CVE-2010-0188.

Users should make sure their browser plug-ins are always up to date when surfing the Web and they should run an antivirus program on their computers at all times, security experts advise.

Leave a Reply

You must be logged in to post a comment.