Upload File

uncovering the secrets of malvertising · uncovering the secrets of malvertising jérôme segura,...

  • Home
  • Documents
  • Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware
29
Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware Intelligence Analyst

Upload: others

Post on 20-Sep-2020

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

UncoveringTheSecretsofMalvertisingJérômeSegura,@jeromesegura,LeadMalwareIntelligenceAnalyst

ChrisBoyd,@paperghost,LeadMalwareIntelligenceAnalyst

Page 2: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Agenda

•Legacyandrealitybehindadvertising

•Malvertising101andsocialengineering

•Evasiontechniquesthatkeepresearchersatbay

•Malvertisingbeyondmalware(scams,fraud)

Page 3: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

10yearsago...

Page 4: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Earlydaysofadblocking•Adoverlaysanger

pornwebmasters

•They'drathersacrifice

trafficalongsidethe

saleslostfrompop-

overredirects

Page 5: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Onlineadsin2016:Onewebsite,mixedmessages

Page 6: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Malvertising (n)Maliciousadvertising istheuseofonlineadvertisingtodistributemalwareorscamswithlittleornouserinteractionrequired.

Page 7: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Malvertisinginthenews…

Page 8: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Theimpact•Millionsofusers

exposed

•Payloadsrange

fromransomware

tobankingTrojans

Page 9: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Malvertising101

Page 10: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

MalvertisingandExploitKits

Maliciousad Redir./Gate ExploitKit Malware

https://blog.malwarebytes.com/threat-analysis/2016/01/msn-home-page-drops-more-malware-via-malvertising/

Page 11: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

AdTechbasics•Publisher:Websitethatdisplaysads

•Creative:Shortfor‘adcreative’,meaninganadvert

•Impression:Referstoanadbeingviewedoncebyavisitor

•Adcall:Thebrowserrequestthattriggersanimpression

•RTB:ARealTimeBiddingauctionforeachimpression

•CPM:Costper1Kimpressions

Page 12: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Whythreatactorsgetontopopularwebsites

Inoneparticularcampaign,withjust$5,threatactorswereabletoexposeoversixthousandpeopletomalware!!!

https://blog.malwarebytes.com/threat-analysis/2015/02/hanjuan-ek-fires-third-flash-player-0day/

• Hugetrafficvolumes• PayPerImpression

becomes‘PayPerInfection’

Page 13: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Howthreatactorsgetontopopularwebsites•Inconsistentguidelinesweakentheadindustry

•Profitvssecurity(i.e.‘arbitrage’)

•3rd partytagscanbehijackedonthefly

•Neweradformats(videoads)

•Exploiting‘Trustedpartners’

•Socialengineeringtobypassadscanners

Page 14: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Fakeadvertisers•Threatactorscreate

fakeprofiles

•Socialengineeringis

usedtodupead

agencies/networks

•It’salongtermgame

Page 15: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Domainshadowing:Stolenidentities•Abuseslegitimate

businesses

•Adbannersarecreated

andhosted‘silently’

•Difficulttofindthe

‘smokinggun’

Page 16: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Domainshadowing:FunwithPhotoshop

Page 17: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Evasiontechniques

Page 18: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

AdsmovingtoHTTPS• The‘adcall’URLinplainHTTPversusHTTPS

Usefulmetadata

Nothingtosee,muchtohide

Page 19: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Anti-researchers,honeypots(fingerprinting)• Identifynongenuinetargetsvia

informationdisclosurebugs

• Readlocalfilenamesviathebrowser

(XMLDOM)

• CheckforMIMEtype(.pcap,.saz)

• Ifvmware,virtualbox,wireshark,etc

arefound,showthe‘cleanad’

Page 20: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Fingerprinting:XMLDOMvuln.

Page 21: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Fingerprinting:XMLDOMandMimeType inaGIF

Page 22: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Malvertisingbeyondmalware

Page 23: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Hidingblockersfrom...blockerblockers?

“Pleasedisableyouradblocker!”“Yes,but…”

Page 24: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Malvertising&scamsWithaVPN WithoutaVPN

Page 25: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Directtobillpaymentsdoneright•Directtobillpayments

– payforserviceswith

nocreditcard

•Merchants

(webmasters)can

subvertpayment

process

SMS- Clicklinkto

confirmacceptance

ofbilling for

product

www.exampleurl.com

555-555-5555

Page 26: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Directtobillpaymentsdonewrong•Advertonforumauto

redirectstoinstant

payment

•Forrefunds...contact

thescammer!

Page 27: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Digitalbecomesrealitybecomes...digi-reality?•Vehicletrackingservespersonalizedads

•Tracking/pricingviabatterystatus

•Augmentedreality

Page 28: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Let’sTakeYourQuestions

LearnMore:malwarebytes.com/business

LatestNews:blog.malwarebytes.com

RequestaTrial:malwarebytes.com/business/licensing

Page 29: Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Thank You!


Uncovering Iterators

MalwareBytes - Malvertising and Ransomware

Today’s Security Threats: Emerging Issues Keeping CFOs Up ... · 4/12/2016  · » Internet scanning » Self-propagating viruses » Malvertising. Malware Command and Control »

Advertsing Integrity: Malvertising, etc

PAD: Programming Third-Party Web Advertisement Censorship · Malvertising campaigns are becoming a prominent threat. According to Cyphort Labs, “by 2013 malvertising increased to

Uncovering Uncertainty through Disagreement 1 Uncovering ...joelchan.me/assets/pdf/2016-acp-mer-uncertainty-conflict.pdf · Uncovering Uncertainty through Disagreement 4 Uncertainty

What is Malvertising? · 2014-11-18 · Infosecurity Magazine August 2014 “Malvertising Campaign may have exposed three million users per day” “Without having to click on anything,

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Revisiting Mobile Advertising Threats with MAdLifewei/papers/ · click fraud and malvertising. We discover that users of click fraud apps are much more likely to experience malvertising

Cyberoam Security Predictions 2015€¦ · Malvertising (placing malware laden advertisements on reputed/popular webpages) is likely to become more of a nuisance in 2015. Ad networks

Uncovering Freemasonry

Uncovering Zimbabwe’s debt - Kubatanaarchive.kubatana.net/docs/econ/zimeuro_uncover_zim_debt_111130.pdf · Uncovering Zimbabwe’s debt Uncovering Zimbabwe’s debt. For the last

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

The Hidden Enemy: Malvertising and Ransomware€¦ · Ransomware. Overview This session will provide a better understanding of the impact of malvertising and ransomware. ... Malwarebytes

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Uncovering - NSTA

Uncovering Violence

Malvertising: The Hidden Threat

User Experience - AdMonsters · Malvertising—malware delivered via digital advertising— ... threat. Since we can now better trace outbreak sources, exchanges and other ad tech

Integrity of the Ad Supply Chain Anti-Malvertising Best ...•Malvertising: can generally refer to “malicious” advertising of various sorts; connotation today is malware drive-by

Uncovering Evidence

Uncovering the Face of Ransomware€¦ · Computer Virus Emergency Response Center, there are 581 infections from this malware and its variants. Another ransomware QiaoZhaz emerged

Advertsing Integrity: Malvertising, etc.espcoalition.org/sites/default/files/news-items/Malvertising for...Cyphort: +325% during 2014; ... As much as half of non-mobile display now

Uncovering Insights

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Uncovering history

UnCovering Religion

Uncovering STEM

Web Privacy Beyond Extensions: New Browsers Are Pursuing … · 2020. 7. 7. · Chrome Edge / IE Firefox Safari Extensions ... edly abused by hackers to serve malware (so-called malvertising)

UNCOVERING ANTICHOLINERGICS

Understanding Malvertising Through Ad-Injecting Browser ...expector.pdf · Understanding Malvertising Through Ad-Injecting Browser ... space on their web pages where online ads

Measuring and Analyzing Search Engine Poisoning of ... · *.0catch.com 732 109 malvertising *.atspace.name 63 17 malvertising hdvidzpro.me 58 58 malvertising wanna .com 49 48 malvertising

FakeAV: Journey From Trojan to a Persistent Threat · Malvertising DeepSec 2011 Serving FakeAV through Advertising networks. Malvertising JavaScript used in New York Times newspaper