1

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware.

the url is this:

PLEASE DON'T OPEN IT, IT MAY DAMAGE YOUR PC!!!

http :// download.abocde.com /Flashplay /APX/ IT/ auload.php?installer= Flash_Player_11_for_Other_Browsers &browser_type= KHTML&dualoffer=false

(I've already reported it to google)

This website opens an alert that notifies that my video flash player is outdated. If I presso OK it downloads me an executable file automatically (without asking for confirm) and starts the application (again without confirm), installing some sort of adware.

I have chrome 33.0.1750.146 on windows, but it seems to work on all browsers.

How can this be possible? Is it using some kind of bug?

After some research I found that the download link of the malware app is this:

filesystem:http:// download.abocde.com/temporary/flashplayer.exe

PLEASE DON'T OPEN IT, IT MAY DAMAGE YOUR PC!!!

What exactly is filesystem:?

6
  • On firefox it does ask to save the file. and the file does not seems that obviously dangerous virustotal.com/en/file/…
    – Kiwy
    Mar 11, 2014 at 13:58
  • What OS and version do you use? It might use some local exploit to get out of the sandbox.
    – Wolfer
    Mar 11, 2014 at 18:01
  • @Wolfer : windows 7 32 bit
    – ProGM
    Mar 11, 2014 at 19:50
  • Is it patched to SP1?
    – Wolfer
    Mar 11, 2014 at 20:31
  • @Wolfer Yes, but I don't think it's a problem with windows...
    – ProGM
    Mar 11, 2014 at 21:26

1 Answer 1

2

Given that the malware seems to target flashplayer.exe I'd expect that the malware uses vulnerabilities in Adobe Flash to attack the system rather than a vulnerability in the underlying OS or the browser.

Adobe flash has been shown to be extremely buggy, and it has been widely attacked as a result. Although Adobe have worked hard to fix the bugs there are still plenty of unknown bugs that can be exploited. Also, many people are not updating flash to the latest version, so there are millions of systems out there.

An attacker also has the benefit that flash works on many operating systems, so vulnerability in flash can lead to compromises on Linux and Mac systems as well as Windows systems.

4
  • 1
    chrome tab are suppose to be sandboxed. it should not be able to make any modification to the system.
    – Kiwy
    Mar 11, 2014 at 13:49
  • 1
    It doesn't look like it targets flashplayer at all. The url is abodce.com, not adobe.com. It is just trying to look like flashplayer.
    – Gray
    Mar 11, 2014 at 13:52
  • 1
    @Kiwy Plugins like Flash are not that easy to sandbox.
    – Philipp
    Mar 11, 2014 at 13:53
  • Dunno how, but it seems to use this API developer.chrome.com/apps/fileSystem
    – ProGM
    Mar 11, 2014 at 13:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .