Cyber criminals are trying to find ways to increase the life cycle of injections in Web sites. Usually, when an attacker gains control of a site, the life span of the injected code to that site depends on how fast the Web site administrator notices malicious content added to their Web pages.
One of the tactics that cyber criminals now employ to increase the life span of injected code is to install rogue modules on to compromised Web servers. These modules hide themselves and the presence of an injection from system and Web site administrators, security researchers, and criminal competitors.
Image 1: The red arrow below shows the difference between the life span of typical malicious injected code and code injected by a rogue Apache module:
A lot of blogs, articles, and forum discussions have appeared about so-called "underground" forums selling all sorts of hacking tools for "penetration testing." We are monitoring these forums and would like to share some information about Web server rootkits. Recently, we've started seeing more tools on sale like Web server rootkits for injecting and hiding malicious code in all Web sites hosted by Web servers. In the past, these tools were sold only in closed communities and to a small set of people, but researchers, Web site administrators, and Web server administrators have uncovered these tools and started to mentioned them in blogs and forums.
We have seen several forum discussions talking about malicious iframes magically appearing on different Web sites and constantly changing the injected URLs. Administrators of affected sites and servers have not been able to identify what the problem is.
Image 2: The following forum discusses how injected iframes are constantly appearing on different sites on a server:
According to underground forums, you can buy the "module Apache/2" for $1,000. Some features described by the seller include iframe injection in php/html/js files, allowing access only by unique IPs, and periodically renewing URLs, all of which add value if used in conjunction with an exploit kit.
Apart from injecting iframes, such modules have a long life cycle, successfully staying in stealth mode and remaining undetected by administrators. Stealth functionality is achieved by collecting and recording IPs used by admins/roots to log into a server, going quiet when the user is logging from these IPs by not showing iFrames to non-unique users, and then going into quiet mode again when suspicious processes like tcpdump are detected. When the admin/root logs off, the module becomes active again.
The author of the rogue Apache module shows in the following statistics how successful this tool has been when used to install rogue AVs with different exploit kits.
Image 3: Stats from exploit kits showing successful exploits with the help of the Web server Apache rogue module:
How does Websense protect customers from malicious code injected by rogue modules?
When an end-user browses to a Web site injected with malicious code, we protect them with our Advanced Classification Engine (ACE). ACE technologies analyze Web sites in real time, guarding against any malicious iFrames that mysteriously appear on Web sites.
One of the conditions that the rogue Apache module allows is for injected code to appear on a Web site only if a user with a unique IP address accesses the Web site for the first time or uses specific referrers. The nature of the rogue Apache module allows injected content to appear or disappear dynamically based on different parameters as described, which makes it much more challenging for security solutions that don't employ real-time content analysis capabilities in their products. Websense real-time analysis parses and analyzes Web sites on the fly and checks for malicious content. When injected code is found, the Web site is blocked and customers are protected.
Image 4: Web site blocked by Websense real-time analytics:
Leave a reply
