Attackers usually use some form of social engineering technique to fool users into downloading and executing a malicious executable - they scare users with a
fake antivirus page, they present users with a video that requires a new
software or codec update, they claim the user's
browser or Flash version is out of date, etc.
Last week, I found several Google search results for popular terms leading directly to a virus download. The following 6 domains were hijacked by attackers:
- pancrase.org
- legacyhealthgroup.com
- movingmidway.com
- playnormous.com
- tombraiderinc.com
- dogbreedsbook.com
When users click on one of these domains in a Google search result page, they are redirected to another domain. This new page ensures that the request has been received from a live user with a web browser. This is accomplished by looking at the user agent and at the Referer value (does the user come from Google?). If the test is successful, the user is then redirected to
vicrtorytrip.net or
gfaster.net.
These 2 domains serve an executable with the name
www.com. It is detected as malicious by only
5 AV vendors out of 42.
 |
| Virustotal result page |
All the redirections are done through HTTP 302 redirections, so no new page is shown to the user. As a result, users may think the file download was done from Google, because it does not appear that they left the Google search result page. This is the "trick" the attackers rely on to ensure that users trust the executable file, in addition to the name
www.com which looks like a domain name rather than a file name.
 |
| Malicious file download attempt |
Once again, the best protection, and often the only one, is to educate users to not download and install any file unless they fully trust its origin, and explicitly requested the download.
-- Julien
Posts
3 comments:
Julien,
Educating users is not the solution. We've tried this for the past 10-15 years, and it's still not working... should we continue to educate them for another 15 before we decide on a different route?
I propose we start thinking as if we didn't have a user at all... ignore the user and design for transparency. We should always be assuming that the user will make something bad even worse and that we cannot rely on them... at all.
Security training and awareness is the cockroach of ideas, it just won't die. Stop feeding!
Very interesting post like the others, thanks! Do you have analyzed the www.com binary. Can you share it?
@clam1 You can find the Anubis report at http://anubis.iseclab.org/?action=result&task_id=1f059764c82947964cdc371be07d56d5d&format=html
Post a Comment