Web attacks use smart redirection to evade URL security scanners

Web attacks based on the Nuclear Pack exploit toolkit check for mouse cursor movement before serving their payload

Security researchers from antivirus vendor ESET have come across new Web-based malware attacks that try to evade URL security scanners by checking for the presence of mouse cursor movement.

The new drive-by download attacks were spotted in the Russian Web space and don't require user interaction to infect computers with malware.

Most attacks of this type rely on hidden iframes being injected into legitimate, but compromised websites, to redirect their visitors to the actual attack page. However the websites affected by this new campaign don't exhibit such rogue elements.

Instead, rogue JavaScript code is being added to local JS files that get loaded in the "head" section of every HTML page, making the infection harder to spot, the ESET security researchers said in a blog post on Friday. Loading JavaScript in this way is a very common practice and is not particularly indicative of a compromise.

The code injected into these local JavaScript files loads a different JS file from an external location, but only if mouse cursor movement is detected on the page. The purpose of the mouse movement detection is to filter out URL scanners and Web crawlers used by security companies or search engines to detect infected websites.

It is a simple technique, but it suggests that cyber criminals are looking for more proactive ways to differentiate between human visitors and automated bots, so they can keep their attacks undetected for longer periods of time, the ESET researchers said. "It’s a natural evolution for drive-by download attacks to include malicious code employing proactive techniques for detecting real user activity and bypassing malware collecting systems."

If the check determines that the request came from a human, the external JavaScript code injects an iframe into the original HTML page on the fly, which then loads attack code from an installation of the Nuclear Pack exploit toolkit.

Like most drive-by download attack tools, Nuclear Pack attempts to exploit remote code execution vulnerabilities in unpatched versions of browser plug-ins such as Java, Adobe Reader or Flash Player, in order to infect victims' computers with malware.

In this case, the Nuclear Pack installation attempts to exploit the CVE-2012-0507 Java vulnerability, which was patched in Java for Windows back in February and in Java for Mac last week, as well as a much older vulnerability in Adobe Reader, which is identified as CVE-2010-0188.

Users should make sure that their browser plug-ins are always up to date when surfing the Web and they should run an antivirus program on their computers at all times, security experts advise.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?