Here's some recent media coverage regarding the SEO poisoning attack through exploiting the ABC of web application security, namely input validation, a good example of tactical warfare combing two different attack tactics, blackhat SEO for traffic acquisition and abusing input validation for injecting iFRAMES, and abusing the sites' search engine optimization practices of storing the now input violated pages. Meanwhile, Iftach Amit at Finjan points out that as it looks like we were on the same page. Here's Google's comment regarding these incidents provided to Finjan :"Google acknowledged that this was a known attack vector, and confirmed that they are indeed working on ways to manipulate and “sanitize” links provided by them in an effort to minimize the effect of incidents such as XSS on indexed sites. They also share our opinion on the reality of XSS and its affects on web browsing: "Google recommends that sites fix their cross-site scripting vulnerabilities as a priority. These can be abused in a number of ways, including bad interactions with search engines. Google is helping by reaching out to affected organizations. In addition, Google has internal processes to block abuses when the situation warrants."
The responsible full-disclosure, namely disclosing and every domain affected, the IPs of the malicious domains used in the redirection, and obtained a sampled result of where are the domains actually leading to, should have had the effect it's supposed to - raise awareness and put responsible pressure on the people involved in taking care of making sure no one can submit executable commands that will later on get cached, and load, such as iFRAMES in this case. Most of all, these are high page rank-ed sites, namely the junk that they submit is appearing within the first 10/20 search results and is getting crawled within hours upon submitting it, and therefore it must be taken care of as soon as possible, on multiple fronts.
- The Other iframe attack
- Optimizing Cross Site Scripting - and general security practices
- Follow up to yesterday's mass hack attack
- Hackers launch massive IFrame attack
- SEO poisoning attacks growing
- Attackers hijacking web site search engines to push malware; German article
- Developers: Check Your %*^& Inputs
- Researcher: Beware of massive IFrame attack
- iFrame attacks: Blame your Web admin guy
- More Search Results Getting iFRAMEd
- Ongoing IFrame attack proving difficult to kill
- Injection attacks target legit websites - twenty-nine thousand sites and counting
- Mass Hack Hits 200,000 Web Pages
- 200.000 nettsider hacket
In an upcoming post, I'll expose many other such fake codecs about to get included in future campaigns, and emphasize on the dynamics of orchestrating such a malicious campaign, namely keep it as sophisticated and as deep-linking/deep-iframing as possible to confuse automated malware aggregation approaches at the beginning of the campaign, and Keep it Simple Stupid at the very end of the campaign.
Malicious economies of scale means an efficient and standardized attack approach, take Rock Phish for instance, but it also means an easy way to detect and mitigate certain threats. In this malicious campaing for instance, nearly all the bogus .info domains with several exceptions are operating within the same netblock, and continue doing so. And the exceptions? It's all a matter of perspective, whether or not you believe having a RBN hosted domain within the actual iFRAME, or the result of the iFRAME redirection in terms of importance.
No comments:
Post a Comment