Web-based malware use smart redirection to evade URL security scanners
Web attacks based on the Nuclear Pack exploit toolkit check for mouse cursor movement before serving their payload
By Lucian Constantin | Published: 15:00, 10 April 2012
Security researchers from antivirus vendor ESET have come across new Web-based malware attacks that try to evade URL security scanners by checking for the presence of mouse cursor movement.
The new drive-by download attacks were spotted in the Russian Web space and don't require user interaction to infect computers with malware.
Most attacks of this type rely on hidden iframes being injected into legitimate, but compromised websites, to redirect their visitors to the actual attack page. However the websites affected by this new campaign don't exhibit such rogue elements.
Related Articles on Techworld
It is a simple technique, but it suggests that cyber criminals are looking for more proactive ways to differentiate between human visitors and automated bots, so they can keep their attacks undetected for longer periods of time, the ESET researchers said. "It’s a natural evolution for drive-by download attacks to include malicious code employing proactive techniques for detecting real user activity and bypassing malware collecting systems."
Like most drive-by download attack tools, Nuclear Pack attempts to exploit remote code execution vulnerabilities in unpatched versions of browser plug-ins such as Java, Adobe Reader or Flash Player, in order to infect victims' computers with malware.
In this case, the Nuclear Pack installation attempts to exploit the CVE-2012-0507 Java vulnerability, which was patched in Java for Windows back in February and in Java for Mac last week, as well as a much older vulnerability in Adobe Reader, which is identified as CVE-2010-0188.
Users should make sure that their browser plug-ins are always up to date when surfing the Web and they should run an antivirus program on their computers at all times, security experts advise.