Can malware change the website visited by browser?

Question

I heard in a security talk today (I didn't have the opportunity to ask questions):

The speaker mentioned that he observed (2 years ago) that a possible malware on a given computer was behaving such that, when the user visits a legitimate URL via the browser, the malware changes the URL that needs to be visited; so the URL in the address bar remains the same, but the page visited is now malicious.

Can someone tell how a malware could achieve this OR is this even possible today ? Is the malware somehow intercepting the request sent by the browser ?

Answer 1

There are several ways to achieve this:

• Malware working as a proxy or directly hooked into the browser (like with browser extensions) can change the content of the site itself, that is one will still visit the original site but the content will be changed in transit or gets changed inside the browser with script injection or similar. This kind of malware is often used to inject advertisements.
• By changing the DNS settings it will return attacker-controlled IP addresses for a host name instead of the real IP addresses. This way all traffic to these hosts goes to the attacker which then can provide different content. DNS settings can be changed on the computer itself or even on the router. In the later case all systems in the local network are effected. See https://nakedsecurity.sophos.com/2012/10/01/hacked-routers-brazil-vb2012/ for a detailed example.
• Otherwise compromised middleboxes (routers, firewalls, proxies) can also be used to change or redirect traffic.

Answer 2

I have also come across rootkits that will intercept DNS requests, and return the correct results for utilities such as nslookup, but a different IP to browsers.

Yet another possibility is malware modifying your /etc/hosts file (or the C:\Windows\System32\Drivers\Etc\Hosts file). I haven't seen that much lately, probably because it is too easy to detect and prevent.

Answer 3

Of course, it is perfectly common and is a standard part of the feature set of all advanced modern-day commercial malware, and has been widespread since the first versions of ZeuS. The page visited via the legitimate URL is normally partially or completely modified on-the-fly.

It is normally achieved by injecting into the browser process and hooking WinAPI system calls, which contain raw HTTP request and response data. This article contains the full list of hooked API calls for ZBot, if you're interested.

Of course, injecting into the process means that the malware should often target specific browser versions. Malware authors commonly list the browsers and their versions which their product can inject, and often update their malware right after the target browsers' update (if they want to stay on the top of the market).

ZeuS, its various modifications, SpyEye, and most other bots with the "browser injection" capability sport a very interesting feature: a small built-in "parsing & replacement language" for their config files that allows malware users to easily configure the changes in HTTP responses for specific pages.

This language is basic text-replacement stuff: one can specify the URL or URL mask for the responses to be modified, and then give a list of replacement blocks, each specifying some data to be inserted (the "body"); data in the original response after which the "body" should be inserted and/or data in the original response before which the "body" should be inserted.

Configs written in this "language", referred to as "injects" or "webinjects", are an actual market of their own. Well-written "webinjects" targeting banks or online payment systems, with their own well-written administration web-panels, can sell for several hundred dollars.

This is mostly used, as you have correctly stated, for phishing. However, it is different from regular phishing in being much harder to identify. It's also often used for advertising and clickfraud.