October 2014

<div dir="ltr" style="text-align: left;" trbidi="on">
<h2>
YouTube Ads lead to exploit kits, YouTube serving ‘malvertising’?</h2>
You
 may have heard of the term malvertising and threats posed by it. 
Malvertising is usually served by hackers using shady sites or hacking 
legitimate ones to spread malware payload.  Researchers at TrendMicro 
Labs have found out that even Google’s own YouTube is being used by 
hackers to show up such rogue ads.  This ads lead users to exploit kits 
which can steal their identity, personal information or banking details. 
The blog report states that, 
<blockquote>
Recently,
 we saw that this campaign was showing up in ads via YouTube as well. 
This was a worrying development: not only were malicious ads showing up 
on YouTube, they were on videos with more than 11 million views – in 
particular, a music video uploaded by a high-profile record label.</blockquote>
TrendMicro
 has been researching on malvertising trends for past few months and 
have come to this surprising conclusion. TrendMicro  goes on to state 
that neither Google and YouTube is serving the malicious ads, rather, 
the hackers seem to be operating from ad campaigns bought from 
legitimate advertisers. TrendMicros state, 
<blockquote>
The
 ads we’ve observed do not directly lead to malicious sites from 
YouTube. Instead, the traffic passes through two advertising sites, 
suggesting that the cybercriminals behind this campaign bought their 
traffic from legitimate ad providers.</blockquote>
<h2>
What is Malvertising</h2>
Here
 is a brief intro into the world of malvertising for your.  Malvertising
 involves injecting malicious or malware laden advertisements into 
legitimate online advertising networks and web pages. Online legitimate 
advertisements provide a solid platform for spreading malware to hackers
 and cyber criminals because of the significant effort is put into them 
in order to attract users and sell or advertise the product. Because 
advertising content can be inserted into high-profile and reputable 
websites and using legitimate advertising networks, it provides the 
hackers a excellent opportunity to inject/execute their malicious 
payload. 
<h2>
How was YouTube used?</h2>
Apparently
 the hackers took to YouTube because it belongs to the search giant 
Google and provides them with excellent opportunity to spread their 
malware. 
In order to make their activity look legitimate,
 the attackers used the modified DNS information of a Polish government 
site. The attackers did not compromise the actual site; instead they 
were able to change the DNS information by adding subdomains that lead 
to their own servers. TrendMicro is unclear as to how the hackers 
achieved this. 
TrendMicro found out that the malvertising
 traffic passed through two redirection servers (located in the 
Netherlands) before ending up at the malicious server, located in the 
United States. 
TrendMicro noticed that exploit kit used 
in YouTube malvertising attack was the Sweet Orange exploit kit. Sweet 
Orange is known for using four vulnerabilities, namely: 
<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2460" target="_blank">CVE-2013-2460 – Java</a> .<a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2460" target="_blank">CVE-2013-2551 – Internet Explorer</a> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0515" target="_blank">CVE-2014-0515 – Flash</a> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0322" target="_blank">CVE-2014-0322 – Internet Explorer</a> 
TrendMicro
 further found that that this particular version of Sweet Orange uses 
vulnerabilities in Microsoft’s Internet Explorer browser to spread its 
malware along with old versions fo Flash and Java. They also noticed 
that The URL of the actual payload constantly changes, but they all used
 the subdomains on the same Polish site mentioned above. Further the, 
the behavior of these payloads are identical. 
TrendMicro found the following hashes as being as part of this attack: 
<blockquote>
09BD2F32048273BD4A5B383824B9C3364B3F2575 0AEAD03C6956C4B0182A9AC079CA263CD851B122 1D35B49D92A6E41703F3A3011CA60BCEFB0F1025 32D104272EE93F55DFFD5A872FFA6099A3FBE4AA 395B603BAD6AFACA226A215F10A446110B4A2A9D 6D49793FE9EED12BD1FAA4CB7CBB81EEDA0F74B6 738C81B1F04C7BC59AD2AE3C9E09E305AE4FEE2D A1A5F8A789B19BE848B0F2A00AE1D0ECB35DCDB0 A7F3217EC1998393CBCF2ED582503A1CE4777359 C75C0942F7C5620932D1DE66A1CE60B7AB681C7F E61F76F96A60225BD9AF3AC2E207EA340302B523 FF3C497770EB1ACB6295147358F199927C76AF21</blockquote>
The final payloads of this attack are variants of the KOVTER malware family, which are detected as <a href="http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/TROJ_KOVTER.SM" target="_blank">TROJ_KOVTER.SM</a>.
 This particular family is known for its use in various ransomware 
attacks, although they lack the encryption of more sophisticated attacks
 like Cryptolocker. The websites that TROJ_KOVTER.SM accesses in order 
to display the fake warning messages are no longer accessible. 
Microsoft
 on its part had already assessed the above said vulnerability in IE and
 released a patch to fix the same in May 2013. Those users who have 
updated IE, Java, and Adobe are safe from this attack. The older version
 you use the more susceptible you are to exploits as they are still 
being used by the cyber criminals. 
TrendMicro has already notified Google and hopefully Google will take actions against the malvertisers soon.</div>

YouTube Malvertising : Ads on YouTube leads users to Sweet Orange exploit kit

YouTube Ads lead to exploit kits, YouTube serving ‘malvertising’? You may have heard of the term malvertising and threats posed by it. ...