4

Issue:

Yesterday I discovered a strange behaviour in the Chefkoch.de App. During the search for recipe,

Example, happened on multiple recipies

Firefox opens up with a (German) phishing warning screen.

German phishing prevention screen

This happened not only on this specific recipe, but on almost every other recipe. My assumption is that it has something to do with the displayed ads. The AEG ad was one of the ads displayed during the issue.

Incidence Response:

Immediately after the attack I wrote an email to the developers. Today I got their answer, that this problem is not new to them, and they think it has something to do with Googles AdExchange service.

Today I tried to analyse the issue a bit more, but I wasn't able to recreate the issue again. I will update my Question with further information if I'll be able to recreate the issue.

Question:

  1. Has anybody knowledge on such attacks? (Google didn't help me.)
  2. How is it possible to create a browser intent, without user interaction, via ads?

Technical Details

  • App Version 2.2.8
  • Android Version: 5.1.1
  • Device: Oneplus One
  • User-Agent: Mozilla/5.0 (Android; Mobile; rv:40.0) Gecko/40.0 Firefox/40.0
  • Time: 01.09.2015 17:10:48

Edit

Some latest research in this field showed an overall Problem of the advertising networks. https://blog.malwarebytes.org/malvertising-2/2015/09/large-malvertising-campaign-goes-almost-undetected/

Improve this question
1
  • 1
    Yet another reason why advertising should die and burn in hell, or at the very least fall back to serving only images and text (rendered by trusted code in the app) instead of serving entire Javascript which can do anything.
    – André Borie
    Commented Sep 2, 2015 at 16:17

2 Answers 2

Reset to default
3

The term you are looking for is "malvertising", or malicious code sent via ad networks.

If the mobile app you used had a known weakness in the code (common libraries) that the malicious code tried to exploit, it is entirely possible that it could launch a browser session.

Improve this answer
1
  • Do you have more information on how the attack works? Are there any known CVEs or more detailed informations which libraries are effected? Logcat showed that they use de.guj.ems.mobile.sdk.controllers.adserver.AmobeeAdResponse. I would like to investigate a bit more, but it seems hard to find any payloads from previous attacks.
    – tintin
    Commented Sep 2, 2015 at 19:10
0

Regarding question 2 (How is it possible to create a browser intent, without user interaction, via ads?):

  • If the ad is server as whole HTML, it could use a meta refresh (<meta http-equiv="refresh" content="5; url=http://example.com/">).
  • If JavaScript is allowed, it could use it to redirect current location to an URI of choice.

But that's not all, it could actually do more than just open some HTTP URI. It could call any BROWSABLE activity with a link such as intent://host1/#Intent;scheme=custom2;package=com.example.helloworld;end

References:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .