Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware.

the url is this:

PLEASE DON'T OPEN IT, IT MAY DAMAGE YOUR PC!!!

http :// download.abocde.com /Flashplay /APX/ IT/ auload.php?installer= Flash_Player_11_for_Other_Browsers &browser_type= KHTML&dualoffer=false

(I've already reported it to google)

This website opens an alert that notifies that my video flash player is outdated. If I presso OK it downloads me an executable file automatically (without asking for confirm) and starts the application (again without confirm), installing some sort of adware.

I have chrome 33.0.1750.146 on windows, but it seems to work on all browsers.

How can this be possible? Is it using some kind of bug?

After some research I found that the download link of the malware app is this:

filesystem:http:// download.abocde.com/temporary/flashplayer.exe

PLEASE DON'T OPEN IT, IT MAY DAMAGE YOUR PC!!!

What exactly is filesystem:?

share|improve this question
    
On firefox it does ask to save the file. and the file does not seems that obviously dangerous virustotal.com/en/file/… –  Kiwy Mar 11 at 13:58
    
What OS and version do you use? It might use some local exploit to get out of the sandbox. –  Wolfer Mar 11 at 18:01
    
@Wolfer : windows 7 32 bit –  ProGM Mar 11 at 19:50
    
Is it patched to SP1? –  Wolfer Mar 11 at 20:31
    
@Wolfer Yes, but I don't think it's a problem with windows... –  ProGM Mar 11 at 21:26

1 Answer 1

Given that the malware seems to target flashplayer.exe I'd expect that the malware uses vulnerabilities in Adobe Flash to attack the system rather than a vulnerability in the underlying OS or the browser.

Adobe flash has been shown to be extremely buggy, and it has been widely attacked as a result. Although Adobe have worked hard to fix the bugs there are still plenty of unknown bugs that can be exploited. Also, many people are not updating flash to the latest version, so there are millions of systems out there.

An attacker also has the benefit that flash works on many operating systems, so vulnerability in flash can lead to compromises on Linux and Mac systems as well as Windows systems.

share|improve this answer
1  
chrome tab are suppose to be sandboxed. it should not be able to make any modification to the system. –  Kiwy Mar 11 at 13:49
1  
It doesn't look like it targets flashplayer at all. The url is abod*c*e.com, not adobe.com. It is just trying to look like flashplayer. –  Gray Mar 11 at 13:52
1  
@Kiwy Plugins like Flash are not that easy to sandbox. –  Philipp Mar 11 at 13:53
    
Dunno how, but it seems to use this API developer.chrome.com/apps/fileSystem –  ProGM Mar 11 at 13:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.