 Number 315 - August 2009 |
|
| Drive-by Infections | |
|
by Brian K. Lewis, Ph.D.*, Sarasota Personal Computer Users Group, Inc. | |
|
How safe do you feel when surfing the web? As a savvy computer user you no doubt keep your computer safe while browsing the web through the use of anti-virus software, firewall software, anti-spyware, etc. These anti-malware applications will protect your computer from dangerous software that can be transferred to your computer by some active means or a "Push" from another source. However, are you aware that your computer can "Pull" malware from a Website without your knowledge or active intervention? Such malware can get through all of your active defenses because it is part of the Web page you are downloading and may appear safe to all of your defenses! Many people think that they couldn't possibly get malware from the Websites they visit because they are all very respectable businesses. Unfortunately, it seems that any Website can become a host to malware. Google has used its Web indexing system to systematically look for malicious Websites over a twelve month period. (The Ghost in the Browser Niels Provos, et. al., Google, Inc.) At least 10% of the 4.5 million sites they had checked, by the time of publication, have "drive-by" downloads. Over 700,000 additional sites have other malware associated with them. So what is a drive-by download? It is the transfer of malware which occurs without any action on the part of the viewer other than the download of the Web page. Just remember you can't see any Web page until the code that produces it has been transferred to your computer's memory and then, put up on your video screen. Usually, most of a Website's content is created by the Website owner. However, as more and more Websites are supported by advertising, they may also display ads from third-party advertising networks. These ads are usually connected to the Web page via external Javascript or iframes. (see the May 2008 issue of the SPCUG Monitor for more on iframes.) Moreover, some sites allow users to contribute their own content, for example via postings to forums or blogs. Depending on the individual site's policies, user contributed content may be restricted to text files, but it often can also contain HTML code (Hyper Text Markup Language) which provides links to images or other external content. HTML is the language used to write web page code. Web pages also may have third-party content such as visitor counters or complex calendars. In Google's research paper they cite a number of examples of code which can be hidden in a Web page. In some cases it can be a simple JavaScript program that redirects the viewer to an entirely different Web page. One example cited was a visitor counter which had its code revised to include a command to change the Web site being viewed. This was inserted some three years after the page was originally published. You might think that changing the page you are viewing would be very obvious in the address line of your browser. However, the info in the address line is not the true address, which is always given by a series of numbers. What you see is a converted name or nickname. So the address shown in the browser can be readily "spoofed" as part of the page redirection by the malware code. The drive-by download uses the browser (Internet Explorer, Firefox, Safari, Opera, etc) as the mechanism to connect computer users to Web servers rigged with malware code. In the drive-by attack, the malware program is automatically downloaded to your computer without your consent or even your knowledge. The attack actually occurs in two steps. The user surfs to a Website that has been rigged with code that in turn redirects the connection to a malicious third-party server hosting malware code. These codes can target vulnerabilities in the Web browser, an unpatched browser plug-in, a vulnerable ActiveX control, or any other third party software flaws such as that found in unpatched Adobe Readers. One example of a problem which might make a user vulnerable to malware is contained in this Microsoft Security Bulletin 03-011. Here is the pertinent quotation from this bulletin. "In order to exploit this vulnerability via the Web-based attack vector, the attacker would need to entice the user into visiting a site the attacker controlled. The vulnerability itself provides no way to force a user to a Website." However, if a script redirects the user's browser without his/her knowledge and the attacker's Website then exploits a known vulnerability in the operating system, it is hardly the user's fault. However if a patch for the specific "hole" is available, but hasn't been installed, then you can certainly blame the user. It is an accepted fact that many, possibly as many as 65% of users do not install the updates to their operating systems. This, in spite of the fact that Microsoft sets automatic downloads and installs as the default method for updating both Windows XP and Vista. Another real world example of a drive-by download involved the Website for the Miami Dolphins. In 2007, before the Super Bowl, one line was inserted into the HTML code for the Dolphin's Website that was designed to cause a transfer to a third party site. A visitor to the Dolphin site, with an unpatched Windows computer, was silently connected to a remote third party that attempted to exploit known vulnerabilities described by Microsoft's MS06-014 and MS07-004 security bulletins. (Note that the 06 and 07 indicate the year the bulletin was issued.) If the exploit was successful, a Trojan was silently installed that gave the attacker full access to the compromised computer. The attacker could later take advantage of the compromised computer in order to steal confidential information or to launch Denial of Service (DoS) attacks. |
Another example of drive-by malware is that found on "poisoned" advertising sites. More and more advertising is appearing on every Website. Users who click on ads may be directed to servers which have been "poisoned" and end up on servers which contain a host of drive-by malware. Another link to malware sites has been shown to be sites selected by certain keywords during Internet searches. For example, the top results of any search containing the word "screensaver" had a 59% chance of including a malware site according to a report published by McAfee (The Webs Most Dangerous Search Terms.) If the search included the term "lyrics" the results had a 25% chance of being malware sites or one out of every four results. This was followed closely by the term "free". Malware "kits" serve as the engine for drive-by downloads. These kits are professionally written software that can be hosted on a server with a database backend. The kits, which are sold on underground hacker sites, are fitted with exploits for vulnerabilities in a range of widely deployed desktop applications, including Apple's QuickTime media player, Adobe Flash Player, Adobe Reader, RealNetworks' RealPlayer, and WinZip. Identity thieves and other malware authors purchase these code kits and deploy them on a malicious server. Code is then embedded on Web sites to redirect traffic to that malicious server. Additionally, lures to those sites are spammed via e-mail or bulletin boards . These kits can also be designed to determine which browser and operating system are being used and their versions. That way a tailored malware application, or applications, can be used to exploit all the possible vulnerabilities. They can also determine the third-party software being used and tailor the response to its vulnerabilities. The lesson from all this says that it is very important for computer users to install the security patches that Microsoft makes available. Many of the exploits identified by various security organizations are related to holes that were patched months and years ago. The problem being that many businesses and individuals do not stay up to date on the installation of these patches. So here are a few ways you can try to protect your computer from drive-by downloads: There is an additional safeguard which most Windows users ignore. You should never surf the Internet while you are running your computer as the Administrator. You should always set up a User account for this purpose. In addition, both the User account and the Administrator account should be password protected. This does not guarantee that you will be protected from "zero-day" exploits, those which have not been patched, but it will reduce the possibility of such events. Last but not least, you can do your surfing from a sandbox. Check out my article on Sandbox Computing in the January 2009 SPCUG Monitor. Always be aware that someone out there is trying to redirect your computer to a malware site and keep your defenses up. * Dr. Lewis is a former university and medical school professor of physiology. He has been working with personal computers for over thirty years, developing software and assembling systems. He can be reached at bwsail at yahoo.com. From the July 2009 issue of the Sarasota PC Monitor, the official monthly publication of the Sarasota Personal Computer Users Group, Inc., P.O. Box 15889, Sarasota, FL 34277-1889. Permission to reprint is granted only to other non-profit computer user groups, provided proper credit is given to the author and our publication. |
|
Number 315 - August 2009
|
|