We also occasionally see instances where static Javascript files are hijacked. These are often much harder to detect. We recently found the following malicious code appended to a static Javascript file on an Indian Telecom website:
Obfuscated Javascript appended to legitimate code
With the help of Malzilla, I've analyzed the Javascript code. It attempts to download another Javascript file from gumblar.cn, a known malicious site.
Deofuscation of one malicious function
Hijacking a static file is much harder than modifying a dynamic page. Many content management systems (Joomla, Drupal, etc.) and blogs (Wordpress, etc.) are hacked through an SQL injection, or through a privilege escalation, which gives attackers access to the templates or the SQL database used to generate the dynamic pages, but does not provide access to static files. An attacker must have greater access to the infected host, as given by a remote PHP file inclusion for example, or the ability to access any sensitive file in order to successfully perform this type of attack.
-- Julien
Posts
0 comments:
Post a Comment