SANS ISC: Image search can lead to malware download

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Reader Stephanie told us that during an image search of a Mussolini image in google found a site downloading malware. I decided to look into this issue further to see what I could find. Before starting, please be careful on what you do, as this page is still alive.

I clicked the image found in google. The following script was received from the host:

The URL loads the following javascript, which is coded:

After decoding, it rises an executable, MD5 ef42a441af5e5a250f18aeb089698c35. It does not perform any changes to the system, but it connects to 69.50.197.243 TCP port 8000 to further download for malware content.

Such attacks are common. How to minimize the risk of these attacks? We can summarize some controls:

• Malware perimeter defense: You can use any malware product to test HTTP, FTP and any other protocol allowed for the inside users.
• Please download files from well-known sites. If you need to download something from unknown sites, please take all measures to check and review the downloaded content before using it.
• I tested noscript against this webpage and it was correctly blocked. I do not recall a similar control for Internet Explorer. Maybe one of our readers can recommend one?
• Host IPS can protect the machine for buffer overflow or similar attacks triggered by exploits or malware.
• And, of course, the Antivirus.

-- Manuel Humberto Santander Peláez | http://twitter.com/manuelsantander | http://manuel.santander.name | msantand at isc dot sans dot org