{"id":3090,"date":"2010-07-31T12:16:22","date_gmt":"2010-07-31T19:16:22","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=3090"},"modified":"2018-01-30T12:34:30","modified_gmt":"2018-01-30T19:34:30","slug":"phishers-want-you-to-have-a-coke-and-a-drive-by","status":"publish","type":"post","link":"https://www.webroot.com/blog/2010\/07\/31\/phishers-want-you-to-have-a-coke-and-a-drive-by\/","title":{"rendered":"Phishers Want You to Have a Coke and a Drive-by"},"content":{"rendered":"

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>As recently as a few months ago, malware distributors went to what looked like great lengths to craft complex, sophisticated Web pages designed to trick visitors into believing they were visiting a page with an embedded video and — oops! — you need to update your copy of Adobe Flash in order to view it.<\/p>\n

\"\"<\/a>Well, those days of hard work seem to have faded into memory. All we’re left now is this.<\/p>\n

In a recent attack that came to my attention, the guys behind the attack didn’t bother to build a sophisticated Web page. Well, nothing along the lines of pages we’ve seen before, with cool graphics, slick design, or interesting programming. In fact, they hardly built a Web page at all.<\/p>\n

In this case, the unknown person or people created an HTML file that loads someone else’s graphic, which happens to be a warning about an outdated version of Flash, that is located elsewhere. Specifically, they load a graphic that just happens to be hosted on the Coca-Cola company<\/a>‘s Web server. This isn’t a site hack against the Coke people — the graphic is probably legitimate, considering how Flash-heavy the Website is — just an example of how pathologically lazy or incompetent some malware distributors can be.<\/p>\n


\n\"\"<\/a><\/p>\n

The hack itself was pretty rudimentary: You visit a page on the malicious domain<\/a>, the graphic appears, and if you click the graphic, it starts the browser downloading a file called adobe_flash_update.exe<\/strong>. Never mind the fact that the real Adobe Flash<\/a> updater doesn’t use a file with this filename to perform its updates.<\/p>\n

\"\"<\/a><\/p>\n

Oh, and if you don’t click the graphic, it doesn’t matter: The page also\u00a0 loads a one-pixel-square iFrame from a Web server running on port 8080\u00a0 on a different domain, named Lunchstroke.ru<\/a>, registered in Russia. That site performs a drive-by download of a different malware payload.<\/p>\n

Both payloads in this scenario are the ubiquitous Trojan-Backdoor-Zbot<\/strong>, a comprehensive password stealer and botnet client. It’s a nasty piece of malware delivered by a haphazard, cruddily built, halfhearted attack which, sadly, probably worked on at least some of its targeted victims—proving once again that social engineering remains the king of the malware jungle.
\n\"wordpress<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

As recently as a few months ago, malware distributors went to what looked like great lengths to craft complex, sophisticated Web pages designed to trick visitors into believing they were visiting a page with an embedded video and — oops! — you need to update your copy of Adobe Flash in order to view it. […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[3915,4997,4985,3563,7743,4895,3619,4999,7747,3477,4909,3919,4647,3629,7745,3471,4161,4313,3901,5947],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3090"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=3090"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3090\/revisions"}],"predecessor-version":[{"id":23821,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3090\/revisions\/23821"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=3090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=3090"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=3090"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=3090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}