Threat Level: green Handler on Duty: Pedro Bueno

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Image search can lead to malware download

Published: 2011-04-23
Last Updated: 2011-04-23 04:59:23 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
8 comment(s)

Reader Stephanie told us that during an image search of a Mussolini image in google found a site downloading malware. I decided to look into this issue further to see what I could find. Before starting, please be careful on what you do, as this page is still alive.

I clicked the image found in google. The following script was received from the host:

Evil Javascript loaded

The URL loads the following javascript, which is coded:

First part of evil script

Last part of script

After decoding, it rises an executable, MD5 ef42a441af5e5a250f18aeb089698c35. It does not perform any changes to the system, but it connects to 69.50.197.243 TCP port 8000 to further download for malware content.

Such attacks are common. How to minimize the risk of these attacks? We can summarize some controls:

  • Malware perimeter defense: You can use any malware product to test HTTP, FTP and any other protocol allowed for the inside users.
  • Please download files from well-known sites. If you need to download something from unknown sites, please take all measures to check and review the downloaded content before using it.
  • I tested noscript against this webpage and it was correctly blocked. I do not recall a similar control for Internet Explorer. Maybe one of our readers can recommend one?
  • Host IPS can protect the machine for buffer overflow or similar attacks triggered by exploits or malware.
  • And, of course, the Antivirus.

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org

8 comment(s)
Diary Archives