Nsauditor Network Security Auditor - Advanced All-In-One Network Tools Suite!
  Recommended Product
Network Security Audit Software
Network Security Audit Software and Computer Security Tools
Download Learn More
Nsauditor Screencast
 
 
  Network Security Software
Network Bandwidth Monitor Network Bandwidth Monitor
NBMonitor tracks Internet bandwidth usage (upload and downloads) and shows process names initiated network connections...
Network Hardware Inventory Software Network Hardware Inventory Software
Nsasoft Hardware Software Inventory is a powerful network inventory software for home, office and enterprise networks...
BlueAuditor Monitors Mobile Devices in Wireless Network BlueAuditor Monitors Mobile Devices in Wireless Network
BlueAuditor is a wireless personal area network auditor and easy-to-use program for detecting and monitoring mobile devices in a wireless network...
Network Access Monitoring Network Access Monitoring
ShareAlarmPro allows easily perform network shares and folder monitoring, block unwanted users attempting to access secured shares...
Network Shares Monitoring Network Share Watcher
Monitors network folders permissions and identify shares which are violating company data access policy...
NetworkSleuth Network File Search Utili NetworkSleuth Network File Search Utiliy
NetworkSleuth is a network file searching utility, that allows you to quickly locate files across a network....
Product Key Finder Product Key Finder
Product Key Explorer enables you to quickly recover over 3000 popular software product keys from network computers...
Backup Key Recovery Crashed Drive Keys Recovery Backup Key Recovery Crashed Drive Keys Recovery
Backup Key Recovery retrieves product keys for Windows, MS Office, SQL Server, Adobe products and more than 2500 popular software products...
 
 

Network Security News

Web attacks use smart redirection to evade URL security scanners

Apr 09, 2012 | ITNews.com

Security researchers from antivirus vendor ESET have come across new Web-based malware attacks that try to evade URL security scanners by checking for the presence of mouse cursor movement.

The new drive-by download attacks were spotted in the Russian Web space and don't require user interaction to infect computers with malware.

Most attacks of this type rely on hidden iframes being injected into legitimate, but compromised websites, to redirect their visitors to the actual attack page. However the websites affected by this new campaign don't exhibit such rogue elements.

Instead, rogue JavaScript code is being added to local JS files that get loaded in the "head" section of every HTML page, making the infection harder to spot, the ESET security researchers said in a blog post on Friday. Loading JavaScript in this way is a very common practice and is not particularly indicative of a compromise.

The code injected into these local JavaScript files loads a different JS file from an external location, but only if mouse cursor movement is detected on the page. The purpose of the mouse movement detection is to filter out URL scanners and Web crawlers used by security companies or search engines to detect infected websites.

It is a simple technique, but it suggests that cyber criminals are looking for more proactive ways to differentiate between human visitors and automated bots, so they can keep their attacks undetected for longer periods of time, the ESET researchers said. "It’s a natural evolution for drive-by download attacks to include malicious code employing proactive techniques for detecting real user activity and bypassing malware collecting systems."

If the check determines that the request came from a human, the external JavaScript code injects an iframe into the original HTML page on the fly, which then loads attack code from an installation of the Nuclear Pack exploit toolkit.

Like most drive-by download attack tools, Nuclear Pack attempts to exploit remote code execution vulnerabilities in unpatched versions of browser plug-ins such as Java, Adobe Reader or Flash Player, in order to infect victims' computers with malware.

In this case, the Nuclear Pack installation attempts to exploit the CVE-2012-0507 Java vulnerability, which was patched in Java for Windows back in February and in Java for Mac last week, as well as a much older vulnerability in Adobe Reader, which is identified as CVE-2010-0188.

Users should make sure that their browser plug-ins are always up to date when surfing the Web and they should run an antivirus program on their computers at all times, security experts advise.

View more news...

 
  Most Popular Articles
 
 
  Email Subscriptions
Enter Your Email to be Notified of Software Updates:

 
 
  Popular Searches
network security magazine network security auditor network security news network security software corporate network security network security systems home network security product key finder password recovery software Network Bandwidth Monitor Network Access Monitoring data access policy monitoring remote shutdown Network File Search key recovery Network Monitoring Computer Security Ethical Hacking Network Security Network Inventory Software Information Security
 
 
  Partner Sites
Network Security Auditor
Nsauditor is a complete networking utilities package that includes more than 45 network tools and utilities for network auditing, scanning,network connections monitoring and more. For more information, please visit:
www.nsauditor.com


Password Recovery Software
SpotAuditor is All-in-one password recovery program that offers administrators and users a comprehensive solution for recovering passwords and other critical business information saved in users' computers. For more information, please visit:
www.password-recovery-software.com

Product Key Explorer
Product Key Explorer quickly recovers and displays product key, including Windows 7 keys, Windows Vista key, Windows XP product key, Microsoft Office 7 product key, MS office 2010 key, Adobe Photoshop, Adobe CS5, CS4, CS3, SQL Server, Electronic Arts games and more than 3000 popular software products:
www.product-key-explorer.com/