Compromised site serves Nuclear exploit kit together with fake BSOD

Posted by   Virus Bulletin on   Jul 31, 2015

Support scammers not lying about a malware infection for a change.

During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.

When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the HTML contains some code — typically JavaScript — that loads content from an ad server, which shows the advertisements in the browser. This means a selection of advertisements can be shown that are deemed the most interesting to the particular user, while it also allows advertisers to bid for "eyeballs".

Malicious websites work in the same way. Indeed, the compromised website in question (which, unsurprisingly, ran a 2008 version of WordPress) contained a little bit of obfuscated JavaScript that inserted an iframe as well as loading another piece of JavaScript, both from the same server. These are two examples of traffic distribution systems (TDS), which are the malicious equivalent of the code used by ad networks to display relevant ads.

  The de-obfuscated JavaScript code added to the compromised website. (Click the image for a larger version.)

What was interesting was that when we opened the site in our test lab, we found that both URLs were opened by the browser. One of them served the Nuclear exploit kit, which used a Flash Player exploit to deliver the Glupteba downloader, which would likely have downloaded another piece of malware. Glupteba is commonly seen as the payload for Nuclear.

The other URL made the browser show a fake BSOD with a pop-up urging the user to call a toll-free US number, where a phone operator would likely trick them into paying a large sum of money for little to no protection. Earlier this month, a Malwarebytes researcher wrote about this particular trick, which despite its apparent simplicity contains some anti-analysis tricks.

  (Click the image for a larger version.)

It is unclear why both pages were served. It might be that the malware authors were just being greedy and trying to maximise their chances of success. It might also be a bug on their site. In any case, for once, support scammers wouldn't have been lying about there being malware present on the victim's machine.

In the VBWeb tests we will test the ability of gateway-based security solutions to block such threats on the network. We are currently running a trial and noted that this infection and social engineering attempt was blocked by several solutions, though not all of them. Those interested in participating in these tests are asked to contact martijn.grooten@virusbtn.com.

  Fiddler capture of the traffic. (Click the image for a larger version.)

This research was performed together with Adrian Luca. We'd like to thank Jerome Segura (who last year spoke on support scams at VB2014, and who is one of the leading experts on exploit kits) for his input.

Posted on 31 July 2015 by Martijn Grooten

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

VB2019 paper: The push from fiction for increased surveillance, and its impact on privacy

In a paper presented at VB2019 in London, researchers Miriam Cihodariu (Heimdal Security) and Andrei Bogdan Brad (Code4Romania) looked at how surveillance is represented in fiction and how these representations are shaping people's attitudes to…

VB2019 paper: Oops! It happened again!

At VB2019 in London industry veterans Righard Zwienenberg and Eddy Willems took a detailed look at the relationship between past and current cyber threats. Today, we publish both their paper and the recording of their presentation.

Job vacancy at VB: Security Evangelist

Virus Bulletin is recruiting for a person to be the public face of the company

VB2019 video: Thwarting Emotet email conversation thread hijacking with clustering

At VB2019 in London, ZEROSPAM researchers Pierre-Luc Vaudry and Olivier Coutu discussed how email clustering could be used to detect malicious Emotet emails that hijacked existing email threads. Today we publish the recording of their presentation.

VB2019 paper: A vine climbing over the Great Firewall: a long-term attack against China

Today we publish a VB2019 paper from Lion Gu and Bowen Pan from the Qi An Xin Threat Intelligence Center in China in which they analysed an APT group dubbed 'Poison Vine', which targeted various government, military and research institutes in China.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.