Compromised site serves Nuclear exploit kit together with fake BSOD

Posted by   Virus Bulletin on   Jul 31, 2015

Support scammers not lying about a malware infection for a change.

During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.

When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the HTML contains some code — typically JavaScript — that loads content from an ad server, which shows the advertisements in the browser. This means a selection of advertisements can be shown that are deemed the most interesting to the particular user, while it also allows advertisers to bid for "eyeballs".

Malicious websites work in the same way. Indeed, the compromised website in question (which, unsurprisingly, ran a 2008 version of WordPress) contained a little bit of obfuscated JavaScript that inserted an iframe as well as loading another piece of JavaScript, both from the same server. These are two examples of traffic distribution systems (TDS), which are the malicious equivalent of the code used by ad networks to display relevant ads.

  The de-obfuscated JavaScript code added to the compromised website. (Click the image for a larger version.)

What was interesting was that when we opened the site in our test lab, we found that both URLs were opened by the browser. One of them served the Nuclear exploit kit, which used a Flash Player exploit to deliver the Glupteba downloader, which would likely have downloaded another piece of malware. Glupteba is commonly seen as the payload for Nuclear.

The other URL made the browser show a fake BSOD with a pop-up urging the user to call a toll-free US number, where a phone operator would likely trick them into paying a large sum of money for little to no protection. Earlier this month, a Malwarebytes researcher wrote about this particular trick, which despite its apparent simplicity contains some anti-analysis tricks.

  (Click the image for a larger version.)

It is unclear why both pages were served. It might be that the malware authors were just being greedy and trying to maximise their chances of success. It might also be a bug on their site. In any case, for once, support scammers wouldn't have been lying about there being malware present on the victim's machine.

In the VBWeb tests we will test the ability of gateway-based security solutions to block such threats on the network. We are currently running a trial and noted that this infection and social engineering attempt was blocked by several solutions, though not all of them. Those interested in participating in these tests are asked to contact martijn.grooten@virusbtn.com.

  Fiddler capture of the traffic. (Click the image for a larger version.)

This research was performed together with Adrian Luca. We'd like to thank Jerome Segura (who last year spoke on support scams at VB2014, and who is one of the leading experts on exploit kits) for his input.

Posted on 31 July 2015 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 conference programme announced

VB is excited to reveal the details of an interesting and diverse programme for VB2019, the 29th Virus Bulletin International Conference, which takes place 2-4 October in London, UK.

VB2018 paper: Under the hood - the automotive challenge

Car hacking has become a hot subject in recent years, and at VB2018 in Montreal, Argus Cyber Security's Inbar Raz presented a paper that provides an introduction to the subject, looking at the complex problem, examples of car hacks, and the…

VB2018 paper and video: Android app deobfuscation using static-dynamic cooperation

Static analysis and dynamic analysis each have their shortcomings as methods for analysing potentially malicious files. Today, we publish a VB2018 paper by Check Point researchers Yoni Moses and Yaniv Mordekhay, in which they describe a method that…

VB2019 call for papers closes this weekend

The call for papers for VB2019 closes on 17 March, and while we've already received many great submissions, we still want more!

Registration open for VB2019 ─ book your ticket now!

Registration for VB2019, the 29th Virus Bulletin International Conference, is now open, with an early bird rate available until 1 July.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.