Menu
Silverlight malvertising exploits on the rise

Silverlight malvertising exploits on the rise

The Angler exploit kit favors Silverlight and Flash exploits over Java, researchers from Cisco said

Microsoft Silverlight vulnerabilities are increasingly being exploited in drive-by download attacks to infect computers with malware, especially through malicious ads.

Attackers have been adding exploits for Silverlight vulnerabilities to their exploit kits, tools that are commonly used to launch Web-based attacks, according to security researchers from Cisco Systems.

"Silverlight exploits are the drive-by flavor of the month," the Cisco security researchers said Monday in a blog post. "Since April 23rd we have observed substantial traffic (often from malvertising) being driven to Angler instances partially using Silverlight exploits."

Angler is the second exploit kit to incorporate Silverlight exploits after a similar tool called Fiesta added exploits for two Silverlight vulnerabilities in January.

Typically when a user is redirected to an attack page, the exploit kit performs a test to determine the users' browser and installed plug-ins -- Flash Player, Java, Adobe Reader, Silverlight, etcetera. If any of them are outdated and vulnerable, the exploit kit serves the corresponding exploit from its available arsenal.

For the past several years, Java has consistently been the most frequently targeted browser plug-in because Java exploits proved to be particularly effective against the large user base with outdated installations, particularly in enterprise environments. However, that's beginning to change.

"In this particular Angler campaign, the attack is more specifically targeted at Flash and Silverlight vulnerabilities and though Java is available and an included reference in the original attack landing pages, it's never triggered," the Cisco researchers said.

The Angler attacks detected recently by Cisco were launched through malicious ads, an action known as malvertising. Specifically, users visited legitimate websites that unknowingly served rogue ads from a compromised ad network. The ads then redirected users' browsers to a hacked website that further redirected them to an Angler landing page.

The Angler attack page loaded a Silverlight exploit that chained two vulnerabilities together -- CVE-2013-3896, patched by Microsoft in October 2013, and CVE-2013-0074, patched in March 2013. If the exploits were successful, a computer Trojan that connects back to a remote server in Brazil was installed, the Cisco researchers said.

"We should expect these existing Silverlight exploits to proliferate through other exploit pack families in the near future as threat actors copy code from each other and release updates," the researchers said. "Silverlight exploits are also ideal because Silverlight continues to gain rich Internet application market share, perhaps surpassing Java, and Microsoft's life cycle schedule suggests Silverlight 5 will be supported through October, 2021."

The Silverlight exploit used in the Angler attack campaign managed to infect about 10 percent of users who reached the landing page, a reasonable success rate for exploit kits, according to the Cisco researchers.

Users who have Silverlight on their computers should make sure that they install the latest available update for the program.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesCisco Systemsonline safetyMicrosoftsecuritypatch managementExploits / vulnerabilitiesmalware

Featured

Slideshows

Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Show Comments