On October 24th, 2013, the admins of the famous php.net website said that their website delivered malware to its visitors using a drive-by download attacK. I have several questions about this malware, however I prefer to ask only few of them since I already found answsers for other questions:

  • I take this quote from this article:

While the userprefs.js code was served to all visitors, only some of those people received an additional payload that contained malicious iframe tags

As I am working around the security of browsers such as FF, GC and IE, I wonder how come a website can legitimately writes into the profile of a Firefox user and writing into its userprefs.js ? How come is this dangerous behavior is a normal thing used by php.net servers ?

  • Always from the quote: are the iframes in such cases ALWAYS hidden ?
  • From the same article, I have a question about this quotation:

some webserver malware runs entirely in memory and hides itself pretty well.

How come a virus can hide itself by running within a memory ?

  • The article does not say that the userprefs.js is the file you assume it is. It is just some JavaScript file that php.net uses. Has nothing to do with the local profile in user's browser. So no worries about that. – bidifx Jul 30 '14 at 14:25

How come a virus can hide itself by running within a memory ?

Most servers are restarted very rarely, perhaps once a year or even longer are common. A server malware can cause sufficiently large damage by running itself once then removing all traces of its executable from the filesystem and live forever until the server is restarted. Many operating systems allows file entries to be removed from the filesystem while remaining open by a process, the file remains accessible in the processes until they die or the process closes the file. Such malware trades off persistence with being harder to detect.

  • 3
    @begueradj Download any piece of serious malware from OpenMalware and you will see for your self. Mandiant has a tool to detect these kinds of activities. You can also do it your self, in an easy maner. If you download metasploit and exploit a target. Mitigate your meterpreter shell to a different process. And you will have code without a binary in memory. – Stolas Jul 30 '14 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy