Silverlight malvertising exploits are on the rise
The Angler exploit kit favors Silverlight and Flash exploits over Java, researchers from Cisco said
IDG News Service - Microsoft Silverlight vulnerabilities are increasingly being exploited in drive-by download attacks to infect computers with malware, especially through malicious ads.
Attackers have been adding exploits for Silverlight vulnerabilities to their exploit kits, tools that are commonly used to launch Web-based attacks, according to security researchers from Cisco Systems.
"Silverlight exploits are the drive-by flavor of the month," the Cisco security researchers said Monday in a blog post. "Since April 23rd we have observed substantial traffic (often from malvertising) being driven to Angler instances partially using Silverlight exploits."
Angler is the second exploit kit to incorporate Silverlight exploits after a similar tool called Fiesta added exploits for two Silverlight vulnerabilities in January.
Typically when a user is redirected to an attack page, the exploit kit performs a test to determine the users' browser and installed plug-ins -- Flash Player, Java, Adobe Reader, Silverlight, etcetera. If any of them are outdated and vulnerable, the exploit kit serves the corresponding exploit from its available arsenal.
For the past several years, Java has consistently been the most frequently targeted browser plug-in because Java exploits proved to be particularly effective against the large user base with outdated installations, particularly in enterprise environments. However, that's beginning to change.
"In this particular Angler campaign, the attack is more specifically targeted at Flash and Silverlight vulnerabilities and though Java is available and an included reference in the original attack landing pages, it's never triggered," the Cisco researchers said.
The Angler attacks detected recently by Cisco were launched through malicious ads, an action known as malvertising. Specifically, users visited legitimate websites that unknowingly served rogue ads from a compromised ad network. The ads then redirected users' browsers to a hacked website that further redirected them to an Angler landing page.
The Angler attack page loaded a Silverlight exploit that chained two vulnerabilities together -- CVE-2013-3896, patched by Microsoft in October 2013, and CVE-2013-0074, patched in March 2013. If the exploits were successful, a computer Trojan that connects back to a remote server in Brazil was installed, the Cisco researchers said.
"We should expect these existing Silverlight exploits to proliferate through other exploit pack families in the near future as threat actors copy code from each other and release updates," the researchers said. "Silverlight exploits are also ideal because Silverlight continues to gain rich Internet application market share, perhaps surpassing Java, and Microsoft's life cycle schedule suggests Silverlight 5 will be supported through October, 2021."
The Silverlight exploit used in the Angler attack campaign managed to infect about 10 percent of users who reached the landing page, a reasonable success rate for exploit kits, according to the Cisco researchers.
Users who have Silverlight on their computers should make sure that they install the latest available update for the program.
- Fight Malware, Malfeasance and Malingering Every year brings more extreme sets of threats than the last. The good news is that there are a range of mitigation options....
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts