6

So I asked this question because I had thought that attackers would have a way to identify client software, because surely if 100 different exploits were spammed against a users machine they would notice?

The answers I got suggest that that is not the case, and indeed the most popular malware kits do just spam a wide variety of exploits hoping to get lucky.

My question then, is how does this happen without users being aware? If you spam PDF or Java or media player exploits, surely the users would notice these programs opening up?

I don't even recall advice to users to be on the lookout for such programs randomly starting up when browsing, which would seem like an obvious clue if this is how drive by downloads work.

So, why are spammed exploits not more obvious?

Improve this question

3 Answers 3

Reset to default
7

Why do you assume the user would notice? Starting a program takes a bit of CPU, a bit of RAM, causes a few disk accesses, but that's pretty low-key. Even geeks who have a CPU meter or other common system monitor in their task bar will probably assume it's just some Javascript on a timer in an opened web page, or a garbage collector, or a scheduled task in the operating system.

Maybe you were expecting the program to display a window? The exploit would take care to hide the window, or run the program without displaying its output in a visible window. A very simple way to do that (but not very discreet) is to start the program minimized (for example, under Windows, you can start a program from the cmd command line with programname /min). There are more sophisticated ways that would hide the program more − under Linux, for example, start the program in a virtual display such as Xvfb; there are ways to do this on Windows as well. And even that assumes the program has a GUI; many exploitable system components can be embedded inside another GUI application (and the exploit would then take care of providing a wrapper application that doesn't actually display anything) or just don't have a GUI.

In a web context, an exploit in the form of some resource (image, document displayed in a plug-in) on a web page could be styled to show as a single pixel in some remote corner, even stacked under some other element for good measure. Who checks all the media used by all the frames of every web page?

Improve this answer
7
  • Because most people would probably notice Adobe Reader opening if they did not initiate it, and it is something that even the most tech unsavy of users could be taught to look out for. I am talking specifically about exploits that would effect a program outside of the browser.
    – Sonny Ordell
    Commented Jun 8, 2011 at 23:16
  • @Sonny: Then my second paragraph applies: just because Adobe Reader is running doesn't mean it's displaying a window. If it doesn't display a window, it's pretty much unnoticeable if you don't go looking for it.
    – Gilles 'SO- stop being evil'
    Commented Jun 8, 2011 at 23:40
  • @Giles, that is interesting. I didn't know it was possible to have a malicious pdf that could execute without adobe reader visibly opening. Would you have any more info on that, or examples of such exploits?
    – Sonny Ordell
    Commented Jun 9, 2011 at 9:48
  • @Sonny: I don't have examples of malware, and don't know about Windows (I just googled for a Windows equivalent to what I know on Linux, I've added a link to my answer). This is commonly done for non-nefarious purposes, such as automated testing of GUI applications.
    – Gilles 'SO- stop being evil'
    Commented Jun 9, 2011 at 10:09
  • 1
    @Sonny: Again, just because these programs open the application (e.g. Acrobat Reader) doesn't mean that the application will show a window. If the application is started in a way that makes it invisible in the GUI, users are unlikely to notice.
    – Gilles 'SO- stop being evil'
    Commented Jun 9, 2011 at 16:35
3

My question then, is how does this happen without users being aware? If you spam PDF or Java or media player exploits, surely the users would notice these programs opening up?

Users need not be aware of it. If you browse to an exploit page made by a recent malware, it is going to exploit an unpatched or recently-patched flaw in your browser. These pages usually contain only the most recent of the attacks, and the exploits are crafted in such way that the user may only notice that a page is taking considerable time to load, nothing else. An exploit page is not going to serve pdf exploits usually, that's another vector of attack. It is going to contain various browser or browser-plugin related exploits such as java or flash, which can be loaded without the user noticing. In the PDF case, you may get send using email or download a pdf file that has embedded exploits that are related to pdf readers, multiple of them, and you will only notice opening the pdf file which is what you intended to do anyway.

So, why are spammed exploits not more obvious?

They are crafted that way. The fact that a page serves your browser 10 different exploits does not necessarily mean that you will see various programs opening up as you seem to assume. Depending on the quality of the exploits, you may not see anything, or may see just for one second some application opening and then disappearing, or in the worst case you may see your browser or pdf reader crash or be presented with an error (usually when your application is patched).

Improve this answer
7
  • @john if you read my question, I am not talking about exploiting the browser directly, but other programs such as Adobe Reader or a media player. Which can be exploited via a browser such as embedding a malicious pdf or mp3 file. I am asking then how people would not notice a pdf reader or media player opening up?
    – Sonny Ordell
    Commented Jun 11, 2011 at 12:12
  • 1
    @Sonny Ordell: Thats not how it usually works, as I say in my answer. A typical exploit page created with a common malware kit, does not have embedded exploits that have to open acrobat for example. That is a different attack, one which creates a pdf file that has exploit code in it, and you have to send it to the user or upload it somewhere.
    – john
    Commented Jun 11, 2011 at 12:34
  • 1
    @Sonny Ordell: In case a web page that loads many exploits tries to exploit pdf too, it targets the pdf browser plugin, and loads it in a hidden iframe, as does with several other vectors like java. The user does not typically see anything.
    – john
    Commented Jun 11, 2011 at 12:41
  • @John, that was my only guess as I said in my reply to Giles. The answer to my question then is using hidden iframes, I suppose.
    – Sonny Ordell
    Commented Jun 11, 2011 at 12:43
  • 1
    @Sonny: If you want to know more details about how do exploit kits work, and how exploit pages are constructed, here is a nice presentation: m86security.com/documents/pdfs/security_labs/Gangsterware.pdf
    – john
    Commented Jun 11, 2011 at 13:00
1

Your premises/assumptions are incorrect. Attackers do have ways to tell what version their victim is using, and many attackers do use this version information to decide which exploits to try. For instance, this is common in the web world. A malicious web page will query various browser APIs to identify the version, and then try exploits against those APIs. For many browser exploits (drive-by downloads), trying to exploit an API does not require any user interaction, does not open any new window, and does not show any visible sign to the user.

There may be some attackers who don't bother to check the version information, but that doesn't mean no one does.

Improve this answer
5
  • Not presumptions/assumptions, as I asked about identifying client software previously, specifically excluding browsers or software listening on a port.
    – Sonny Ordell
    Commented Jun 9, 2011 at 9:47
  • 1
    @Sonny -- huh? I don't understand what you are saying. I'm wondering if you might have misinterpreted some answers you previously got, or if there is some other miscommunication here.
    – D.W.
    Commented Jun 10, 2011 at 4:08
  • I am talking about exploiting user programs, not browsers. E.G. Adobe Reader. How would you exploit adobe reader without it visibly opening up?
    – Sonny Ordell
    Commented Jun 11, 2011 at 12:11
  • 1
    @Sonny, the Adobe Reader browser plugin exports APIs that can be accessed by Javascript running on a web page (e.g., navigator.plugins, new ActiveXObject("AcroPDF.PDF"), etc.). This allows a malicious web page to interact with Adobe Reader without visibly opening a new window. The same is true for Quicktime, Java, Realplayer, Flash, Windows Media Player, etc.
    – D.W.
    Commented Jun 11, 2011 at 18:14
  • not all programs have a browser plugin, and even if they do they do not all have it set to be enabled. My question is not so easily dismissed when you consider things such as these.
    – Sonny Ordell
    Commented Jun 12, 2011 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .