Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware.

the url is this:


http :// /Flashplay /APX/ IT/ auload.php?installer= Flash_Player_11_for_Other_Browsers &browser_type= KHTML&dualoffer=false

(I've already reported it to google)

This website opens an alert that notifies that my video flash player is outdated. If I presso OK it downloads me an executable file automatically (without asking for confirm) and starts the application (again without confirm), installing some sort of adware.

I have chrome 33.0.1750.146 on windows, but it seems to work on all browsers.

How can this be possible? Is it using some kind of bug?

After some research I found that the download link of the malware app is this:



What exactly is filesystem:?

share|improve this question
On firefox it does ask to save the file. and the file does not seems that obviously dangerous… – Kiwy Mar 11 '14 at 13:58
What OS and version do you use? It might use some local exploit to get out of the sandbox. – Wolfer Mar 11 '14 at 18:01
@Wolfer : windows 7 32 bit – ProGM Mar 11 '14 at 19:50
Is it patched to SP1? – Wolfer Mar 11 '14 at 20:31
@Wolfer Yes, but I don't think it's a problem with windows... – ProGM Mar 11 '14 at 21:26

Given that the malware seems to target flashplayer.exe I'd expect that the malware uses vulnerabilities in Adobe Flash to attack the system rather than a vulnerability in the underlying OS or the browser.

Adobe flash has been shown to be extremely buggy, and it has been widely attacked as a result. Although Adobe have worked hard to fix the bugs there are still plenty of unknown bugs that can be exploited. Also, many people are not updating flash to the latest version, so there are millions of systems out there.

An attacker also has the benefit that flash works on many operating systems, so vulnerability in flash can lead to compromises on Linux and Mac systems as well as Windows systems.

share|improve this answer
chrome tab are suppose to be sandboxed. it should not be able to make any modification to the system. – Kiwy Mar 11 '14 at 13:49
It doesn't look like it targets flashplayer at all. The url is, not It is just trying to look like flashplayer. – Gray Mar 11 '14 at 13:52
@Kiwy Plugins like Flash are not that easy to sandbox. – Philipp Mar 11 '14 at 13:53
Dunno how, but it seems to use this API – ProGM Mar 11 '14 at 13:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.