How to stop malware in a 'Flash'

By John Strand, Contributor | Dec 8, 2008

1 comments

Facebook

LinkedIn

Digg

Over the past few months, a number of legitimate sites have become unfortunate hosts of malware, specifically in the form of Flash objects that purport to be part of a legitimate advertisement. This malware has been found on sites like Expedia.com, The Economist and MLB.com. One of my favorites is a pop-up box which claims a user's system is infected. If the user selects "OK" to allow the pop-up to "clean" their systems, they become victims. If they select "Cancel," their systems are still infected.

An odd detail about how this malware works is it does not activate with every click. Many of the malware samples that have been analyzed either trigger on X number of clicks, or function by a preset timer. This makes analysis difficult; it can be hard to recreate a specific attack. It's not only a challenge for the systems administrators of the sites that are inadvertently hosting the malware, but may also prove difficult for a team trying to replicate the conditions to perform a solid root-cause analysis of the infection, which is a key of any incident-response plan.

But can't sites simply scan the ads they host? Unfortunately, to scan ads successfully, websites need to be able to create a blacklist of known bad domains from which to block ads, but unfortunately this approach doesn't work. Even trying to see where the malicious advertisements are redirected can be difficult, since they may be redirecting to a number of "legitimate" sites like ad.doubleclick.net, which may then redirect to the malware content. Sometimes multiple ad redirects are used before malware is activated. There is a great video describing this type of malicious attack as it was discovered on MLB.com.

Preparing for Flash-based malware
Flash-based malware can be created using a number of tools that make the generation of Flash objects easier, allowing developers to tie two objects together, much like wrappers for executables. In other words, an attacker can take his malicious code and wrap it in a seemingly legitimate program, like a Flash video. When the user runs the Flash video, the malicious code will also be executed. If, for any reason, the malicious software needs to install something that requires permission of the user, it is not uncommon for a pop-up box requesting install permission to be used. As we now know, many users will install the application without a second thought, perhaps believing it is required to view the content.

1 comments

Facebook

LinkedIn

Digg