I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware.

the url is this:


http :// download.abocde.com /Flashplay /APX/ IT/ auload.php?installer= Flash_Player_11_for_Other_Browsers &browser_type= KHTML&dualoffer=false

(I've already reported it to google)

This website opens an alert that notifies that my video flash player is outdated. If I presso OK it downloads me an executable file automatically (without asking for confirm) and starts the application (again without confirm), installing some sort of adware.

I have chrome 33.0.1750.146 on windows, but it seems to work on all browsers.

How can this be possible? Is it using some kind of bug?

After some research I found that the download link of the malware app is this:

filesystem:http:// download.abocde.com/temporary/flashplayer.exe


What exactly is filesystem:?

  • On firefox it does ask to save the file. and the file does not seems that obviously dangerous virustotal.com/en/file/… – Kiwy Mar 11 '14 at 13:58
  • What OS and version do you use? It might use some local exploit to get out of the sandbox. – Wolfer Mar 11 '14 at 18:01
  • @Wolfer : windows 7 32 bit – ProGM Mar 11 '14 at 19:50
  • Is it patched to SP1? – Wolfer Mar 11 '14 at 20:31
  • @Wolfer Yes, but I don't think it's a problem with windows... – ProGM Mar 11 '14 at 21:26

Given that the malware seems to target flashplayer.exe I'd expect that the malware uses vulnerabilities in Adobe Flash to attack the system rather than a vulnerability in the underlying OS or the browser.

Adobe flash has been shown to be extremely buggy, and it has been widely attacked as a result. Although Adobe have worked hard to fix the bugs there are still plenty of unknown bugs that can be exploited. Also, many people are not updating flash to the latest version, so there are millions of systems out there.

An attacker also has the benefit that flash works on many operating systems, so vulnerability in flash can lead to compromises on Linux and Mac systems as well as Windows systems.

  • 1
    chrome tab are suppose to be sandboxed. it should not be able to make any modification to the system. – Kiwy Mar 11 '14 at 13:49
  • 1
    It doesn't look like it targets flashplayer at all. The url is abodce.com, not adobe.com. It is just trying to look like flashplayer. – Gray Mar 11 '14 at 13:52
  • 1
    @Kiwy Plugins like Flash are not that easy to sandbox. – Philipp Mar 11 '14 at 13:53
  • Dunno how, but it seems to use this API developer.chrome.com/apps/fileSystem – ProGM Mar 11 '14 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.