0

In this video, an experienced Ubuntu user manages to infect his system with some sort of malware.

This is the first example I've ever seen of truly successful malware in the wild aside from privilege escalation.

I have learned my lesson and since disabled Flash, but I'm still curious, how was this able to infect the system?

An explanation was provided in the video, but the exact mechanism was not clear to me.

1

As with most remote exploits targeting a 3rd party plugin (i.e, Adobe Flash, in this case), the attacker used a malformed compressed flash video to corrupt the embedded flash player on the victim.

The exact mechanisms are unclear to me as I have no intent on clicking on the video you linked because that video COULD be malware itself... however, the mechanisms are always the same: at some point a data buffer of some size that was improperly parsed was able to override some key values in memory that resulted in either data leakage or remote execution on the victim.

The fact that it was a Flash movie is not surprising in and of itself. Some older vulnerabilities in Flash player, that I'm aware of, involve dereferencing invalid blocks for the size of the images embedded in the video and drawing outside the allocated canvas region. Basically, the attacker changed the dimensions of the image/video such that they were valid according to the flash scripting language but were invalid in practice and thus when the flash player tried to assemble the content it corrupted memory.

What's particularly fun/interesting is the targeting of Linux - because Windows is the dominant target for these kinds of attacks. Linux tends to be more challenging because users are typically more cognizant of their threat level and take precautions. That's obviously not a golden rule by any means, but if you're playing around with Linux you are at least trying to learn how systems work much more so than being a straight Windows user.

  • It's an HTML5 video on youtube (at least it is for me since I have flash disabled). Is there some danger there? – user36556 Jul 27 '14 at 16:07
  • If you have FLASH disabled it doesn't matter whether the youtube site tries to load the SWF or not - you SHOULD be protected. There are two forms of youtube (unless they got rid of the first - I dont think they have). The first is the shortcut form and that takes you directly to a flash video. The second is the full-page form and that takes you to an HTML5 page. The URL you pasted seems to fit the second one - HTML5. See this link for more details: webapps.stackexchange.com/questions/35817/… – Nick Jul 27 '14 at 16:16
  • As for there being danger in an HTML 5 page - Absolutely. There's danger anytime you download content from the Internet. That said, it's about managing risk and the less you expose your system to the better. I have done no research on HTML5 vulnerabilities so I cannot speak to there being any inherent risk there, but anytime your system downloads arbitrary data and you rely on your system to parse that data there could be an issue. – Nick Jul 27 '14 at 16:19
  • 1
    Assuming you had managed to control the Flash plugin (which is quite likely) and broken out of the sandbox (which is less likely) so that you can inject an iframe onto a page rendered by another process of your browser, why on earth would you not already serve your malicious load or contact your C2C server for instructions? Why the indirection!? – Steve Dodier-Lazaro Jul 27 '14 at 19:25
  • Maybe you don't control the webserver... You use a popular hosted service such as youtube ;) Then unwitting users that implicitly trust that content provider will disable any security checks. If you do control the webserver then I agree that you can simply launch known-browser attacks. HOWEVER, the power you gain from a flash plugin is that you can bypass anonymizer plugins and such. Flash can be used to determine the real OS, so things that mask your web client (e.g., chrome, firefox, IE) and your os (IOS, Windows, Linux) can be defeated first making your attack more likely to succeed. – Nick Jul 28 '14 at 11:33
1

The video show too little information to confirm it is a success attack.

There is too much to explain. Because whole infection involve a chain of workflow process. A really simple break down :

  1. A webpage contains injected XSS that notify the attacker server. Typical browser behaviour will send user agent(browser version, OS info) to the server.
  2. Attacker server will response with a scrip that asking for browser plugin installed. (Checkout EFF panopticlick on browser user-agent exposure )
  3. After getting the client browser response, it check which plugin are subject to exploit and send new stuff over, it can be Flash file, PDF file, video file,etc that contains exploit.
  4. The unpatched browser plugin just load the exploit contents and execute whatever the hidden code told.
  5. If the OS didn't stopped the plugin for "illegal memory operation", then the plugin execute the code and download more contents from attacker server and execute on user machine.

However, browser crash doesn't mean it is a success exploit. Sometime it just mean OS hammer down browser plugin attempt to do funny things, like buffer overflow exploit.

0

I believe this has nothing to do with drive-by downloads as the author claims. It just seems to me that he visited a website that had been injected with an iFrame containing the malicious site (a form of Cross-Site Scripting attack).

He says his browser crashed and that's it. It's hard to test more without actually visiting the page where the incident originally occurred, which he does not seem to report?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy