16

I heard in a security talk today (I didn't have the opportunity to ask questions):

The speaker mentioned that he observed (2 years ago) that a possible malware on a given computer was behaving such that, when the user visits a legitimate URL via the browser, the malware changes the URL that needs to be visited; so the URL in the address bar remains the same, but the page visited is now malicious.

Can someone tell how a malware could achieve this OR is this even possible today ? Is the malware somehow intercepting the request sent by the browser ?

  • 3
    DNS poisoning could do exactly this. – schroeder Apr 7 '15 at 4:43
  • Not only possible but really easy. If the website is a bank then the lack of a real security certificate should be a giveaway. – A E Apr 7 '15 at 18:02
  • 9
    Q: "Can malware..." A: "Yes!" – oefe Apr 7 '15 at 19:52
30

There are several ways to achieve this:

  • Malware working as a proxy or directly hooked into the browser (like with browser extensions) can change the content of the site itself, that is one will still visit the original site but the content will be changed in transit or gets changed inside the browser with script injection or similar. This kind of malware is often used to inject advertisements.
  • By changing the DNS settings it will return attacker-controlled IP addresses for a host name instead of the real IP addresses. This way all traffic to these hosts goes to the attacker which then can provide different content. DNS settings can be changed on the computer itself or even on the router. In the later case all systems in the local network are effected. See https://nakedsecurity.sophos.com/2012/10/01/hacked-routers-brazil-vb2012/ for a detailed example.
  • Otherwise compromised middleboxes (routers, firewalls, proxies) can also be used to change or redirect traffic.
  • If I assume the malware is running on the computer, then from the responses one of the following is a possibility: Browser: Extension; OS: /etc/hosts, local DNS settings (if DNS server is local), intercept DNS requests (via some rootkit); Can anything else be included ? – Jake Apr 7 '15 at 18:14
  • For DNS settings on the computer .. are you referring to /etc/hosts or something else ? – Jake Apr 7 '15 at 18:21
  • 1
    @Jake: local proxy software like superfish, malware injecting intro the browser process (not only extensions can do this), changing the proxy of the browser (hard coded or by misusing autodetect), redirecting traffic with local firewall settings ... and probably more. – Steffen Ullrich Apr 7 '15 at 18:21
  • 1
    @Jake: There are multiple ways to manipulate DNS locally, like /etc/hosts, hard coding DNS servers for the network interface, capturing outgoing DNS requests by malware and replying with their own response, manipulating DHCP responses... – Steffen Ullrich Apr 7 '15 at 18:23
7

I have also come across rootkits that will intercept DNS requests, and return the correct results for utilities such as nslookup, but a different IP to browsers.

Yet another possibility is malware modifying your /etc/hosts file (or the C:\Windows\System32\Drivers\Etc\Hosts file). I haven't seen that much lately, probably because it is too easy to detect and prevent.

1

Of course, it is perfectly common and is a standard part of the feature set of all advanced modern-day commercial malware, and has been widespread since the first versions of ZeuS. The page visited via the legitimate URL is normally partially or completely modified on-the-fly.

It is normally achieved by injecting into the browser process and hooking WinAPI system calls, which contain raw HTTP request and response data. This article contains the full list of hooked API calls for ZBot, if you're interested.

Of course, injecting into the process means that the malware should often target specific browser versions. Malware authors commonly list the browsers and their versions which their product can inject, and often update their malware right after the target browsers' update (if they want to stay on the top of the market).

ZeuS, its various modifications, SpyEye, and most other bots with the "browser injection" capability sport a very interesting feature: a small built-in "parsing & replacement language" for their config files that allows malware users to easily configure the changes in HTTP responses for specific pages.

This language is basic text-replacement stuff: one can specify the URL or URL mask for the responses to be modified, and then give a list of replacement blocks, each specifying some data to be inserted (the "body"); data in the original response after which the "body" should be inserted and/or data in the original response before which the "body" should be inserted.

Configs written in this "language", referred to as "injects" or "webinjects", are an actual market of their own. Well-written "webinjects" targeting banks or online payment systems, with their own well-written administration web-panels, can sell for several hundred dollars.

This is mostly used, as you have correctly stated, for phishing. However, it is different from regular phishing in being much harder to identify. It's also often used for advertising and clickfraud.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.