Web attacks use smart redirection to evade URL security scanners

Web attacks based on the Nuclear Pack exploit toolkit check for mouse cursor movement before serving their payload

Security researchers from antivirus vendor ESET have come across new Web-based malware attacks that try to evade URL security scanners by checking for the presence of mouse cursor movement.

The new drive-by download attacks were spotted in the Russian Web space and don't require user interaction to infect computers with malware.

Most attacks of this type rely on hidden iframes being injected into legitimate, but compromised websites, to redirect their visitors to the actual attack page. However the websites affected by this new campaign don't exhibit such rogue elements.

Instead, rogue JavaScript code is being added to local JS files that get loaded in the "head" section of every HTML page, making the infection harder to spot, the ESET security researchers said in a blog post on Friday. Loading JavaScript in this way is a very common practice and is not particularly indicative of a compromise.

The code injected into these local JavaScript files loads a different JS file from an external location, but only if mouse cursor movement is detected on the page. The purpose of the mouse movement detection is to filter out URL scanners and Web crawlers used by security companies or search engines to detect infected websites.

It is a simple technique, but it suggests that cyber criminals are looking for more proactive ways to differentiate between human visitors and automated bots, so they can keep their attacks undetected for longer periods of time, the ESET researchers said. "It’s a natural evolution for drive-by download attacks to include malicious code employing proactive techniques for detecting real user activity and bypassing malware collecting systems."

If the check determines that the request came from a human, the external JavaScript code injects an iframe into the original HTML page on the fly, which then loads attack code from an installation of the Nuclear Pack exploit toolkit.

Like most drive-by download attack tools, Nuclear Pack attempts to exploit remote code execution vulnerabilities in unpatched versions of browser plug-ins such as Java, Adobe Reader or Flash Player, in order to infect victims' computers with malware.

In this case, the Nuclear Pack installation attempts to exploit the CVE-2012-0507 Java vulnerability, which was patched in Java for Windows back in February and in Java for Mac last week, as well as a much older vulnerability in Adobe Reader, which is identified as CVE-2010-0188.

Users should make sure that their browser plug-ins are always up to date when surfing the Web and they should run an antivirus program on their computers at all times, security experts advise.

Join the CSO newsletter!

Error: Please check your email address.

More about Adobe Systems

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place