Blog

In July 2014, RiskIQ observed continuation of attack activity against the AskMen.com website and their visitors, with injected code redirecting browsers to exploits served from Nuclear Pack.

In April 2014, Cyphort published an analysis of a drive-by download attack traced to malicious code injection on the website of AskMen.com, a leading online Men's magazine portal. The attackers had compromised the site to inject encoded JavaScript into the site in order to redirect site visitors to exploits served from a Fiesta exploit kit installation. In this attack, victims were served a variant of the Miuref malware, known as a common clickfraud and ad-hijacking trojan.

Based on the success of several high profile attacks (ex. Target & AT&T) over the last year exploiting access points created by enterprises connecting into their third-party associates, there's a growing concern that third-parties present potentially intolerable levels of risk to the enterprise. While the purpose of exploiting third-parties in recent highly publicized breach cases had been gaining access to sensitive areas of affiliated enterprises' internal networks, there's another more insidious threat and this one could be even more dangerous. The threat is malware embedded somewhere along the amalgamation of websites, webpages, ads, mobile apps, etc. that a consumer surfing the web would falsely assume belongs to a given organization. This assumption could result from being directed to the page via search engine, the company name or brand appearing in the URL, and/or logos, trademarks, products and services being present on the website, webpage, or mobile app actually hosted on third-party infrastructure. The problem is that users often mistake these assets -- which generally have fewer security controls in place -- for corporately controlled ones and are willing to share sensitive information, which creates unsafe environment for cyber criminals to exploit.

Adding to the problem is that the modern security discourse around third-party data leaks is more focused on low percentage chance, complex APTs that are costly to carry out, require many moving parts and take years to develop. Organizations should be more concerned with phishing or water holing attacks on an enterprise affiliated website targeting consumers because they are cost effective, relatively low-tech, low-risk and potentially high value. In a recent article on CSO magazine, author Taylor Armerding provides evidence that third-party vendors are weak points. He quotes ZeroPoint Risk Research CEO MacDonnell Ulsch, "almost without exception, a third-party vendor or affiliate is involved (in a successful cyber attack)." Interestingly, MacDonnell wrote about this a year ago, before Target and At&T were breached. Armerding points out that a phishing attack on HVAC led to the leak of millions of Target customer credit cards -- all it took was an employee clicking on a malicious link. Similarly, AT&T disclosed that their mobile customers were breached through their third-party vendor and account information, like social security numbers and dates of birth, was compromised.

Amerdering stresses in his article that no enterprise can live on an island and needs multiple relationships with outside vendors, contractors, affiliates, partners and others to function in a connected world. In the chaos of ever expanding and disparate online public interactions points propped up across enterprise and their associates to serve consumers, the ramifications of varying levels of security controls across the online distribution chain create the perfect hiding place for compromised digital assets embedded with well hidden pieces of malware. It is incredibly difficult to gain visibility into the resulting security grey area. RiskIQ offers technology capable of discovering -- with an automated an ongoing process -- all websites and mobile applications associated in any way with a given enterprise. We provide an outside-looking-in perspective as we crawl assets at Internet scale allowing enterprises to view their network from the vantage of the millions of online users interacting with them on a daily basis. If something malicious exists and can be tied in anyway to a RiskIQ customer, it will be identified and swift action will be taken to remove it before it causes harm.

Peter Zavlaris, Marketing Analyst & Resident Blogger

On May 28th, RiskIQ detected a malvertising (malicious advertising) campaign on several high profile websites (ranked within the top 2,000 websites globally), including the popular humor site eBaum's World. This particular campaign utilized a drive-by download to exploit several different versions of software, including Flash, Silverlight, and Java. In this particular case, the malicious ads were served by AppNexus, but this campaign has been seen in several other ad networks as well.

In this example, a user browsing a cat playing Jenga on eBaum's World would have been delivered an advertisement that contained a drive by exploit through the advertisement. This example is illustrated below. The exploit kit that was utilized in the drive-by malware was Angler Exploit Kit, which has been gaining traction since Blackhole Exploit kit has started to lose criminal users. The migration of this user base is related to the arrest of "Paunch" last October. Predictions of hackers moving to different exploit kits have proven to be true, and Angler seems to be filling the void left by Blackhole.

As recently as November of last year, Angler authors integrated Silverlight exploits, which is particularly troubling since Netflix requires the Silverlight plugin to stream video on PC browsers. This provides a large user base to target and while it is not as widely deployed as the Adobe Flash plugin, it is estimated that the majority of internet users have this plugin installed.