Posté par: igor51 le janvier 24, 2018, 18:00:38
[html]
Malvertising occurs when an online advertising network knowingly or unknowingly serves up malicious advertisements on a website. Malvertisements are a type of “drive-by” threat that tend to result in users being infected with malware for simply visiting a website. The victims of this threat are often compromised when the malvertisement directs them to an exploit kit (EK) landing page. Depending on the applications running on the user’s system, the EK can successfully load malware into a system without user consent and without tipping the victim off that something suspicious is happening.
It is not uncommon for popular ad servers to redirect to affiliate networks – organizations that forward traffic to servers supporting other malicious domains, which are referred to as “Cushion Servers” or “Shadow Servers”. Under control of EK actors, some cushion servers use HTTP redirect protocols such as 301/302/303 etc., or simply iframe redirects. In other cases the visitor receives pages containing a script that the attacker has injected. This is often the consequence of an unmitigated vulnerability that attackers may exploit to their advantage. Some campaigns use the domain shadowing technique to camouflage rogue ad servers as legitimate advertisers.
In this blog, we will look into some of the prominent malvertising campaigns that were active during the last four months, as well as the cushion servers related to different exploit kits.
Magnitude EK
As seen in Figure 1, Magnitude EK is a popular exploit kit in the APAC region. Throughout the final quarter of 2016 and first month of 2017, FireEye Dynamic Threat Intelligence (DTI) observed consistent Magnitude EK hits from several customers, the majority of whom reside in the APAC region.
Figure 1: Zone distribution for Magnitude EK activity as seen on DTI in last 4 months
In all cases, Magnitude EK affected web servers with the following header information:
“Apache/2.2.15 (CentOS) DAV/2 mod_fastcgi/2.4.6”.
A successful Magnitude EK infection follows the stages seen in Figure 2.
Figure 2: Typical path for malvertising to Magnitude EK
Figure 3: TLD distribution of first layer domains with injected redirect script
Throughout the last four months, different malvertising campaigns have been associated with a group of first layer compromise pages (the TLD distribution is seen in Figure 3), which we will discuss based on common indicators. These first layer compromise pages use the same injected script used for redirection to Magnitude EK. Figure 4 shows a typical injected script used in these campaigns.
Figure 4: Typical malicious injected script used for redirection to Magnitude domains
In all observed instances, the injected script only appears when the site is being loaded through the advertisement (many of which have high Alexa ranking, as we will further explain), and not when those URLs are accessed directly.
FireEye notifications have resulted in many of these campaigns being taken down, which are mentioned in their respective sections.
Through Propeller Ad Networks
Table 1 shows the domains we observed that acted as first layer compromise domains with the injected script for redirection to Magnitude EK being spread from the advertisers, with domains hosted on the Webzilla B.V domain hosting service.
Table 1: Domains with injected redirect script involved in this campaign
These domains appear to be from the same actor due to the similar nature of the URI and domain patterns, and the switching to new domains after one is used a certain number of times. The current IP involved in hosting the active domains is 37.130.229.108. Domains seen in Table 1 were redirected by the following advertisers mentioned in Table 2.
Table 2: Ads used in this campaign
A typical URI seen in this campaign appears as:
btcpaying[.]uk/?reg=asia&traff=propeller
On rare occasions the same campaign also used advertiser poptm[.]com hosted on Cloudflare, but for the most part the ad networks listed in Table 2 were used.
The Bill-Finance and Flash Games Gates
Some malvertisements have been leading users to Flash game websites. In these instances, domains containing the word ‘finance’ in their domain name are being used as the first layer of compromise for the injected script, which redirects to domains hosting Magnitude EK. These Flash sites are registered with ‘AlpNames Limited’ registrar and have been hosted using a PlusServer AG server ISP in Germany.
Registrant information for all of these sites is similar. The registrant name is some variation of the name ‘Bill’ and ‘Guil’ (e.g ‘Billii’, ‘Billy’ etc.). Registrant numbers have consistently been +1.2285161853 or +1.7137015286.
Table 3 shows the names of these Flash game websites and Table 4 shows their malvertising information.
Table 3: Domains with injected redirect script involved in this campaign
Table 4: Ads used in this campaign
The ads from click.seodollars[.]com appear to be using the domain shadowing technique, while all others are legitimate advertisers.
AlpNames Limited registrar has taken down domains associated with this campaign following notification by FireEye.
TTA Adults Limited Using Adcash Ad Group
This category of first layer of compromise is for domains registered under [.]organisation: TTA ADULTS LIMITED. In all instances, the registrant information is as follows:
Registrant Name: Andrew Musgrove
Registrant [.]organization: TTA ADULTS LIMITED
Registrant Street: FOURTH AVENUE UNIT 1B FOCUS 4