Hack Yourself!
26/06/2007 Written by Roberto Preatoni (SyS64738)
SANS Internet Storm Center published a bulletin on Friday that casts a new light on the capabilities of Social Engineering. The report describes a website whose visitors were infected with malware. And here is the problem since according to the author, Mr. Bojan Zdrnja, the site didn’t use the nearly universal technique of an iframe, which allows exploit code to be siphoned in from another website .
So what? We are facing a case of pure Social Engineering technique.. and quite an effective one.
As reported by the Internet Storm Center, “ When visited, the web page in question (a game site related to RuneScape) shows couple of broken icons and all links just point to another web page that conveniently inform the user that his version of Macromedia Flash Player needs to be updated. After this notice, the user is redirected to a web site hosting a complete replica of the Shockwave Player Download Center”.
See the screen shot in the image below:
In the copy of Adobe’s website the attacker added the Java Script:
“var message=””;
///////////////////////////////////
function clickIE() {if (document.all) {(message);return false;}}
function clickNS(e) {if
(document.layers||(document.getElementById&&!document.all)) {
if (e.which==2||e.which==3) {(message);return false;}}}
if (document.layers)
{document.captureEvents(Event.MOUSEDOWN);document.onmousedown=clickNS;}
else{document.onmouseup=clickNS;document.oncontextmenu=clickIE;}
document.oncontextmenu=new Function(“return false”)”
The downloaded malware contains a full installer that, when tested on VirusTotal, had very low detection.
Actually, the fake website is quite easy to reckon, but careless users could easily be tricked.
