Javascript Malware: How does it work, and how can it be mitigated?

Question

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application and what an application can do to at least inform it's users that the popup is not from the website, it's from the malware.

Answer 1

Drive-by downloads are typical malware vectors for JavaScript to get binaries onto a user's machine. The JS just starts a request of a malware binary that responds with Content-disposition:attachment which prompts the user to download it.

The JS can continue this even if the user cancels, effectively making the user's browser unusable (they may not know how to kill a process manually) and often attempts to make the download look like antivirus software.

Some proportion of users will accept the download just to get their browser back, and then the malware vendor just has to wait for the binary to be run.

---

The core problem with viruses and malware is that the OS confuses the current user with the programs they run. When I run Solitaire, that process has the ability to edit every file that I can from the command line or Windowing system. That should not be the case.

There's no reason why Solitaire or a screensaver that you download from the web needs access to your tax files, so you can use a combination of cues to figure out what privileges it needs

• Did the user grant authority via a file dialog or some other OS-mediated designation method like drag-n-drop? ("Secure Interaction Design") explains a variety of ways to infer grants of authority by looking at the way they interact with a user-interface.
• Is the file in a directory "owned" by the application by virtue of being created during the installation of the application binary?
• Is the file a common system resource like a DLL or shared library?

Other privileges can be similarly granted based on user designation or simple rules.

Most operating systems and applications were not written with this in mind, so systems like Polaris from HP labs shows how to allow apps to run with less than current-user permissions on Windows.

People often forget that POLA means two things at the same time. Not only must you prevent the application from having more authority than it needs to do the user's job, but also you must ensure that the application has enough authority to do that user's job. Granting too much authority is why there are viruses that hijack applications. Granting too little authority means that the application is useless, like a spreadsheet program in a web browser sandbox that cannot save the result on your hard disk. Polaris gives neither too much nor too little authority: while a polarised application cannot in general corrupt or infect files on your computer, the application can indeed store information to any file that the user explicitly specifies by either double-clicking on the file or by selecting the file in a dialog box. Thus, the Polaris system dynamically adjusts the authority of the application to do what the user wants.

Unlike static sandboxes, Polaris does not appreciably affect the user experience. In fact, one HP executive used a pre-Alpha version of Polaris for three days without knowing it was on his machine. Polaris does its magic without changing applications or the operating system. Nor does it rely on intercepting system calls. Instead, when users "Polarize" an application, the "Polarizer" creates a restricted user account for that application. When users launch the application, either explicitly via the shortcut the Polarizer created or implicitly by opening a file of the appropriate type, Polaris uses a variant of the Windows runAs facility to open the program in its account. The bulk of the Polaris software hides this fact from the user.

Answer 2

The attacker can use a vulnerability on the browser to execute the malware code on the client's computer. Most malware that I seen obscure their shell code using Base64 and compression inside a JS file or embedded into the HTML. Once the JS code is executed on the clients computer, it uses 'deflate' and 'eval' to execute whatever code is encoded on the string. The malware usually takes advantage of a buffer overflow vulnerability on the browser to execute shell code on the clients machine.

If you are getting multiple random pop-outs from legitimate website, this may be an indication that the computer is possibly infected with something. Make sure that your AV and Anti-Spyware solutions are up to date and running correctly. Also, check whats running on the computer using tools like process explorer and autoruns.

Answer 3

JavaScript gives web pages authors, good and bad, the ability to run any code they want when your browser visits or is steered to their page. Although the various JavaScript implementations have some security functions to try and keep JS code from doing anything overtly hostile to your computer, two problems emerge: that code has bugs, such as discussed in the earlier answers, which allow for attack or exploitation and many things that aren't outright hostile can lead to bad ends (eg a popup from a FakeAV which asks for your payment information).

Example current Javascript-related attack techniques that are quite effective use hidden iframes to load JS malware from other compromised sites which then tries to execute in the browser. This is seen in advertisements included into big popular sites as well as in less well-trafficked ones. If successful it may then continue on to exploit local system software. In this manner the various versions of the Black Hole Exploit Kit attack vulnerable versions of PDF and Flash software to infect the host machine with botnet clients.

It's been difficult for browser and system makers to make their legitimate messages hard to counterfeit. Windows User Account Control is one of the best techniques because of how it interrupts every other program when it needs privileges to complete a task. Most browser and software pop-up messages are easily faked and you should be wary of them.

To avoid much of this use browser add-ons, plugins, and configuration to only allow JavaScript from sites you trust or sites you authorize. NoScript for Firefox is quite effective at reducing these risks.