Image search can lead to malware download
Last Updated: 2011-04-23 04:59:23 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
Reader Stephanie told us that during an image search of a Mussolini image in google found a site downloading malware. I decided to look into this issue further to see what I could find. Before starting, please be careful on what you do, as this page is still alive.
I clicked the image found in google. The following script was received from the host:
The URL loads the following javascript, which is coded:
After decoding, it rises an executable, MD5 ef42a441af5e5a250f18aeb089698c35. It does not perform any changes to the system, but it connects to 69.50.197.243 TCP port 8000 to further download for malware content.
Such attacks are common. How to minimize the risk of these attacks? We can summarize some controls:
- Malware perimeter defense: You can use any malware product to test HTTP, FTP and any other protocol allowed for the inside users.
- Please download files from well-known sites. If you need to download something from unknown sites, please take all measures to check and review the downloaded content before using it.
- I tested noscript against this webpage and it was correctly blocked. I do not recall a similar control for Internet Explorer. Maybe one of our readers can recommend one?
- Host IPS can protect the machine for buffer overflow or similar attacks triggered by exploits or malware.
- And, of course, the Antivirus.
-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org
Comments
www
Nov 17th 2022
6 months ago
EEW
Nov 17th 2022
6 months ago
qwq
Nov 17th 2022
6 months ago
mashood
Nov 17th 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Nov 23rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
isc.sans.edu
Dec 3rd 2022
6 months ago
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.
<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
isc.sans.edu
Dec 26th 2022
5 months ago
isc.sans.edu
Dec 26th 2022
5 months ago