Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK. I have several questions about this malware, however I prefer to ask only few of them since I already found answsers for other questions:

  • I take this quote from this article:

While the userprefs.js code was served to all visitors, only some of those people received an additional payload that contained malicious iframe tags

As I am working around the security of browsers such as FF, GC and IE, I wonder how come a website can legitimately writes into the profile of a Firefox user and writing into its userprefs.js ? How come is this dangerous behavior is a normal thing used by php.net servers ?

  • Always from the quote: are the iframes in such cases ALWAYS hidden ?
  • From the same article, I have a question about this quotation:

some webserver malware runs entirely in memory and hides itself pretty well.

How come a virus can hide itself by running within a memory ?

share|improve this question
    
The article does not say that the userprefs.js is the file you assume it is. It is just some JavaScript file that php.net uses. Has nothing to do with the local profile in user's browser. So no worries about that. –  bidifx Jul 30 at 14:25
1  
@bidifx read the article, or at least the quotation :) –  begueradj Jul 30 at 14:34
1  
Of cause I read the article. What are you trying to tell me? My point is: You think the manipulated userprefs.js is the file that Firefox uses to store your settings on your PC. But that is not what the article says. Here userprefs.js is some JavaScript that is used by the Website. Like so: <script src="http://php.net/foo/scripts/userprefs.js" type="text/javascript"></script> Two different files, same filename. I'm still not sure what the source of our misunderstanding is.... :-/ –  bidifx Jul 31 at 7:52
    
@bidifx Ok, thank you for pointing me this fact, so basically you answered me the first question, thank you. –  begueradj Jul 31 at 8:04

1 Answer 1

How come a virus can hide itself by running within a memory ?

Most servers are restarted very rarely, perhaps once a year or even longer are common. A server malware can cause sufficiently large damage by running itself once then removing all traces of its executable from the filesystem and live forever until the server is restarted. Many operating systems allows file entries to be removed from the filesystem while remaining open by a process, the file remains accessible in the processes until they die or the process closes the file. Such malware trades off persistence with being harder to detect.

share|improve this answer
    
Interesting, thank you. Could you give me a link to something official that sustains your answer ? –  begueradj Jul 30 at 9:45
3  
@begueradj Download any piece of serious malware from OpenMalware and you will see for your self. Mandiant has a tool to detect these kinds of activities. You can also do it your self, in an easy maner. If you download metasploit and exploit a target. Mitigate your meterpreter shell to a different process. And you will have code without a binary in memory. –  Stolas Jul 30 at 9:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.