Compromised site serves Nuclear exploit kit together with fake BSOD

Posted by   Virus Bulletin on   Jul 31, 2015

Support scammers not lying about a malware infection for a change.

During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.

When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the HTML contains some code — typically JavaScript — that loads content from an ad server, which shows the advertisements in the browser. This means a selection of advertisements can be shown that are deemed the most interesting to the particular user, while it also allows advertisers to bid for "eyeballs".

Malicious websites work in the same way. Indeed, the compromised website in question (which, unsurprisingly, ran a 2008 version of WordPress) contained a little bit of obfuscated JavaScript that inserted an iframe as well as loading another piece of JavaScript, both from the same server. These are two examples of traffic distribution systems (TDS), which are the malicious equivalent of the code used by ad networks to display relevant ads.

  The de-obfuscated JavaScript code added to the compromised website. (Click the image for a larger version.)

What was interesting was that when we opened the site in our test lab, we found that both URLs were opened by the browser. One of them served the Nuclear exploit kit, which used a Flash Player exploit to deliver the Glupteba downloader, which would likely have downloaded another piece of malware. Glupteba is commonly seen as the payload for Nuclear.

The other URL made the browser show a fake BSOD with a pop-up urging the user to call a toll-free US number, where a phone operator would likely trick them into paying a large sum of money for little to no protection. Earlier this month, a Malwarebytes researcher wrote about this particular trick, which despite its apparent simplicity contains some anti-analysis tricks.

  (Click the image for a larger version.)

It is unclear why both pages were served. It might be that the malware authors were just being greedy and trying to maximise their chances of success. It might also be a bug on their site. In any case, for once, support scammers wouldn't have been lying about there being malware present on the victim's machine.

In the VBWeb tests we will test the ability of gateway-based security solutions to block such threats on the network. We are currently running a trial and noted that this infection and social engineering attempt was blocked by several solutions, though not all of them. Those interested in participating in these tests are asked to contact martijn.grooten@virusbtn.com.

  Fiddler capture of the traffic. (Click the image for a larger version.)

This research was performed together with Adrian Luca. We'd like to thank Jerome Segura (who last year spoke on support scams at VB2014, and who is one of the leading experts on exploit kits) for his input.

Posted on 31 July 2015 by Martijn Grooten

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

Red Eyes threat group targets North Korean defectors

A research paper by AhnLab researcher Minseok Cha looks at the activities of the Red Eyes threat group (also known as Group 123 and APT 37), whose targets include North Korean defectors, as well as journalists and human rights defenders focused on…

VB announces Threat Intelligence Summit to take place during VB2018

We are very excited to announce a special summit, as part of VB2018, that will be dedicated to all aspects of threat intelligence.

VB2018 Small Talk: An industry approach for unwanted software criteria and clean requirements

An industry approach for defining and detecting unwanted software to be presented and discussed at the Virus Bulletin conference.

VB2018 call for last-minute papers opened

The call for last-minute papers for VB2018 is now open. Submit before 2 September to have your abstract considered for one of the nine slots reserved for 'hot' research.

VB2017 paper and update: Browser attack points still abused by banking trojans

At VB2017, ESET researchers Peter Kálnai and Michal Poslušný looked at how banking malware interacts with browsers. Today we publish their paper, share the video of their presentation, and also publish a guest blog post from Peter, in which he…

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.