Compromised site serves Nuclear exploit kit together with fake BSOD

Posted by   Virus Bulletin on   Jul 31, 2015

Support scammers not lying about a malware infection for a change.

During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.

When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the HTML contains some code — typically JavaScript — that loads content from an ad server, which shows the advertisements in the browser. This means a selection of advertisements can be shown that are deemed the most interesting to the particular user, while it also allows advertisers to bid for "eyeballs".

Malicious websites work in the same way. Indeed, the compromised website in question (which, unsurprisingly, ran a 2008 version of WordPress) contained a little bit of obfuscated JavaScript that inserted an iframe as well as loading another piece of JavaScript, both from the same server. These are two examples of traffic distribution systems (TDS), which are the malicious equivalent of the code used by ad networks to display relevant ads.

  The de-obfuscated JavaScript code added to the compromised website. (Click the image for a larger version.)

What was interesting was that when we opened the site in our test lab, we found that both URLs were opened by the browser. One of them served the Nuclear exploit kit, which used a Flash Player exploit to deliver the Glupteba downloader, which would likely have downloaded another piece of malware. Glupteba is commonly seen as the payload for Nuclear.

The other URL made the browser show a fake BSOD with a pop-up urging the user to call a toll-free US number, where a phone operator would likely trick them into paying a large sum of money for little to no protection. Earlier this month, a Malwarebytes researcher wrote about this particular trick, which despite its apparent simplicity contains some anti-analysis tricks.

  (Click the image for a larger version.)

It is unclear why both pages were served. It might be that the malware authors were just being greedy and trying to maximise their chances of success. It might also be a bug on their site. In any case, for once, support scammers wouldn't have been lying about there being malware present on the victim's machine.

In the VBWeb tests we will test the ability of gateway-based security solutions to block such threats on the network. We are currently running a trial and noted that this infection and social engineering attempt was blocked by several solutions, though not all of them. Those interested in participating in these tests are asked to contact martijn.grooten@virusbtn.com.

  Fiddler capture of the traffic. (Click the image for a larger version.)

This research was performed together with Adrian Luca. We'd like to thank Jerome Segura (who last year spoke on support scams at VB2014, and who is one of the leading experts on exploit kits) for his input.

Posted on 31 July 2015 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

New Emotet spam campaign continues to bypass email security products

On Monday, the infamous Emotet malware resumed its spam campaign to spread the latest version of the malware. As before, the malware successfully bypasses many email security products.

Book review: Cyberdanger: Understanding and Guarding Against Cybercrime

Security researcher Paul Baccas reviews Eddy Willems' book 'Cyberdanger'.

Programme for VB2019 Threat Intelligence Practitioners' Summit announced

In the mini-summit, which forms part of VB2019 (the 29th Virus Bulletin International Conference), eight sessions will focus on all aspects of threat intelligence collecting, using and sharing.

Guest blog: TotalAV uncovers the world’s first ransomware

In a guest blog post by VB2019 Silver partner TotalAV, Matthew Curd, the software’s Technical Expert, considers the changes in the cybersecurity landscape.

Guest blog: Targeted attacks with public tools

Over the last few years SE Labs has tested more than 50 different security products against over 5,000 targeted attacks. In this guest blog post Stefan Dumitrascu, Chief Technical Officer at SE Labs, looks at the different attack tools available, how…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.