openxadvertising.com Mass Malvertising Campaign

-->

On Monday, Government Security News (GSN), reported that their website had been compromised during a mass infection. While in the case of the GSN infection, the injected content was delivered from googlecodehosting.com, we have determined that the same content was also delivered from googlecodehosting.org and googlecodehosting.net, all of which resolve to 89.45.14.87 and are now offline.

In reviewing our logs for sites with the aforementioned referrers, indicating that they too were/are compromised, we have thus far identified 65 different sites (see list below), with the earliest referrers appearing on Thursday June 13 at 6:32:28 2013 GMT. Referers for the GSN site appeared as early as Jun 14th, suggesting that the site was likely compromised for a couple of days before they became aware of the situation and took steps to clean the site.

The attack leveraged the following chain of events:

1.     Malvertising – The injected code appears to have occurred in malicious advertisements used by the impacted sites, as opposed to the sites themselves. The malicious advertisements were delivered from openxadvertising.com, which is currently blocked by Google SafeBrowsing.

2.     Redirect – The content hosted at the googlecodehosting pages (now offline) has been archived on Pastebin.  As can be seen, the actual malware is being pulled from compromised WordPress sites.

3.     Infection – A malicious .jar file is delivered. At least two separate Java vulnerabilities have been observed in the attacks (CVE-2013-1493 and CVE-2013-2423), which are used to install the ZeroAccess Trojan.

The following infected domains have been identified in this attack from reviewing referer headers referencing googlecodehosting.com/net/org:

·      2475-lsxtv.voxcdn.com

·      ads.rahesabz.net

·      ads.thehiveworks.com

·      delaware.newszap.com

·      disabilitynow.org.uk

·      dj1067fm.com

·      greenhomeguide.com

·      insanescouter.org

·      lamega.com

·      marinefuel.com

·      mess.troutcave.net

·      omahanightlife.com

·      openx.multimediajamaica.com

·      pacificweddings.com

·      supernormalstep.com

·      test.theeagle.com

·      traveloregon.com

·      truthdig.com

·      vmblog.com

·      www.adrants.com

·      www.artshound.com

·      www.beginnertriathlete.com

·      www.birmingham365.org

·      www.brambletonian.net

·      www.charlestongolfguide.com

·      www.clashmusic.com

·      www.cobizmag.com

·      www.controleng.com

·      www.dragzine.com

·      www.ediblemanhattan.com

·      www.empirepage.com

·      www.environmentalleader.com

·      www.first30days.com

·      www.girlswithslingshots.com

·      www.guideposts.org

·      www.hospitalmedicine.org

·      www.hot-dinners.com

·      www.jeepsunlimited.com

·      www.jewishjournal.com

·      www.knittinghelp.com

·      www.lakestclair.net

·      www.lethbridgeherald.com

·      www.lsxtv.com

·      www.menuclub.com

·      www.nowplayingaustin.com

·      www.onedirt.com

·      www.phillyfunguide.com

·      www.popco.net

·      www.pro-touring.com

·      www.questionablecontent.net

·      www.radiohitz92fm.com

·      www.rtbookreviews.com

·      www.sayfiereview.com

·      www.sermonspice.com

·      www.spearfishingplanet.com

·      www.sportscollectorsdaily.com

·      www.stangtv.com

·      www.success.com

·      www.talentzoo.com

·      www.thejc.com

·      www.ventura-usa.com

·      www.wannabebig.com

·      www.whichbudget.com

·      www.workerscompensation.com

·      www.worthgoing.com

For those wishing to implement IDS based signatures to prevent the attacks, the following unique strings have been identified in URL paths seen to be delivering the malicious .jar files:

"/.cache/?f=site.jar&k=" OR

"/.cache/?f=atom.jar&k="

followed by:

"&h="

This attack is very similar to one that we blogged about in May. That attack was also a mass infection, which impacted media sites and also leveraged the ZeroAccess Trojan. As a courtesy, communication has been sent to the webmasters of all impacted domains informing them of the potential infection.

- michael