Drive-by Download RIG Exploit Kit

Size: px

Start display at page:

Download "Drive-by Download RIG Exploit Kit"

えりかちゃわんや
5 years ago
Views:

1 2017 StarC Drive-by Download

2 Drive-by Download RIG Exploit Kit (1) Drive-by Download (2) (3) RIG Exploit Kit (4)

3 Web Web Drive-by Download [1] Drive-by Download Web Web Web Drive-by Download Exploit Kit Exploit Kit Web Exploit Kit Drive-by Download Exploit Kit RIG Exploit Kit [2][3][4] RIG Exploit Kit IP IP URL URL 1 IP RIG Exploit Kit RIG Exploit Kit Drive-by Download Exploit Kit RIG Exploit Kit RIG Exploit Kit IP RIG Exploit Kit RIG Exploit Kit [5] 1

4 2 Drive-by Download Exploit Kit 2.1 Drive-by Download Drive-by Download 4 (1) Web Web Web Web SNS URL Web Web Web Web Web (2) Web User-Agent (3) Web (4) 4 Exploit Kit 2.2 RIG Exploit Kit RIG Exploit Kit (1) Web Web (2) RIG Exploit Kit URL (3) URL iframe RIG Exploit Kit (4) RIG Exploit Kit Web JavaScript Web 2

2.1 RIG Exploit Kit (5) RIG Exploit Kit RIG Exploit Kit RIG Exploit Kit URL URL Drive-by Download Exploit Kit as a Service Exploit Kit Exploit Kit as a Service Exploit

5 2.1 RIG Exploit Kit (5) RIG Exploit Kit RIG Exploit Kit RIG Exploit Kit URL URL Drive-by Download Exploit Kit as a Service Exploit Kit Exploit Kit as a Service Exploit Kit Exploit Kit Exploit Kit 2.3 Exploit Kit Web Drive-by Download [7] RIG Exploit Kit Web RIG Exploit Kit RIG Exploit Kit [6] NTT RIG Exploit Kit URL IP RIG Exploit Kit [8] 3

6 3 Drive-by Download 3 1. Drive-by Download Web 2. Web RIG Exploit Kit RIG Exploit Kit IP 2 3. RIG Exploit Kit Seamless 4. RIG Exploit Kit IP RIG Exploit Kit RIG Exploit Kit 3.1 (1) Drive-by Download Alexa Top 1 Million Web Web Exploit Kit Web Exploit Kit

7 3.1.2 pseudo-darkleech pseudo-darkleech pseudo-darkleech 3.1 Exploit Kit html body top span Exploit Kit iframe IP HTTP Status Code 500 IP RIG Exploit Kit RIG Exploit Kit JavaScript JavaScript Afraidgate EITest GoodMan pseudo-darkleech Seamless /position:absolute; top:-([0-9]3,4)px/ /var ([a-za-z]4,8) = iframe / /div style=ẃidth:1px; height:1px; pos ition:absolute; left:-500px; top:-500px;/ /span style= position:absolute; top:-([0-9]3,4)px; width:([0-9]3)px; height:([0-9]3)px; / /iframe width= 0 scrolling= no height= 0 frameborder= 0 src=.+ seamless= seamless / 3.2 Afraidgate 0 0% EITest % GoodMan 19 0% pseudo-darkleech % Seamless 0 0% 5

8 3.1 pseudo-darkleech 3.2 JavaScript 3.3 eval() eval() 3.4 Base64 Base Web Web User-Agent User-Agent 3.3 CVE CVE Microsoft Internet Explorer JScript 3.2 (2) (1) Drive-by Download Web 6

9 3.3 JavaScript 3.4 eval() StarC Drive-by Download StarC VirtualBox StarC URL OpenVPN URL OpenVPN VPN VPN Fiddler Wireshark 7

10 3.5 CVE URL URL Internet Explorer 3 Fiddler Wireshark Windows Downloads temp 8

11 3.3 User-Agent Windows CVE CVE CVE SWF Vulnerability Internet Explorer 8 XP 32 Bit Internet Explorer 8 XP 64 Bit Internet Explorer 8 Vista 32 Bit Internet Explorer 8 Vista 64 Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit Internet Explorer Bit 3.4 StarC OS CentOS 6.9 Software VirtualBox 5.1 PHP StarC OS Windows 7 Professional 32bit Software Internet Explorer 9 Adobe Flash Player 20 Java Runtime Environment 7 Fiddler 4 Wireshark 2.4 Drive-by Download IP VPN IP Fiddler HTTPS Wireshark HTTP/HTTPS 9

3.6 Campaign Count Fobos 43 Ngay 34 Motors 27 Rulan 14 Seamless 2 13 3.7 Exploit Kit Exploit Kit Count RIG 127 KaiXin 4 Terror 2 3.2.2 2017 6 21 12 13 Drive-by Download Web StarC 133 3.

12 3.6 Campaign Count Fobos 43 Ngay 34 Motors 27 Rulan 14 Seamless Exploit Kit Exploit Kit Count RIG 127 KaiXin 4 Terror Drive-by Download Web StarC Exploit Kit Fobos Campaign Fobos Campaign Web (Malvertising) RIG Exploit Kit StarC Fobos Campaign StarC Fobos Campaign Fobos Campaign RIG Exploit Kit Decoy Web Gate Web Decoy 10

イトへリダイレクトされると Decoy サイトはアクセス元の IP アドレスが過去に Fobos Campaign へアクセスしたことがあるか判定するアクセスしたことがある場合は無害な Web サイトが表示されるがそうではない場合は Gate へ繋がる iframe を含んだ Web サイトを表示する Gate

で観測した Decoy サイトの一例を図 3.8 に示す図 3.8 Fobos Campaign の Decoy サイトの例 3.2.

13 イトへリダイレクトされると Decoy サイトはアクセス元の IP アドレスが過去に Fobos Campaign へアクセスしたことがあるか判定するアクセスしたことがある場合は無害な Web サイトが表示されるがそうではない場合は Gate へ繋がる iframe を含んだ Web サイトを表示する Gate は RIG Exploit Kit へ繋がる iframe を含んだ Web サイトであり Gate へアクセスすることで RIG Exploit Kit で攻撃が行われる Fobos Campaign の Decoy サイトは不規則に変化し多くがカジノやギャンブルに関する Web サイトとなっていた StarC で観測した Decoy サイトの一例を図 3.8 に示す図 3.8 Fobos Campaign の Decoy サイトの例 Ngay Campaign Ngay Campaign は 2017 年 8 月頃から観測報告がある攻撃キャンペーンである 8 月頃には Disdain Exploit Kit を用いていたという報告もあるが現在では Fobos Campaign と同じように RIG Exploit Kit を用いる Malvertising 系の攻撃キャンペーンである StarC で観測した Ngay Campaign のトラフィックを図 3.9 に示す図 3.9 StarC で観測した Ngay Campaign 11

3.8 Ngay Campaign ngay18.tk campngay16.tk testcamp20.ga Ngay Campaign Gate RIG Exploit Kit Gate RIG Exploit Kit iframe Ngay Campaign Gate.tk.ml Freenom ngay camp day StarC Ngay Campaign Gate 3.8 3.2.5 Motors Campaign Motors Campaign 2017 10 11 Fobos Campaign Ngay Campaign RIG Exploit Kit Malvertising StarC Fobos Campaign 3.

14 3.8 Ngay Campaign ngay18.tk campngay16.tk testcamp20.ga Ngay Campaign Gate RIG Exploit Kit Gate RIG Exploit Kit iframe Ngay Campaign Gate.tk.ml Freenom ngay camp day StarC Ngay Campaign Gate Motors Campaign Motors Campaign Fobos Campaign Ngay Campaign RIG Exploit Kit Malvertising StarC Fobos Campaign StarC Motors Campaign Motors Campaign Fobos Campaign Decoy Gate Decoy Gate iframe Web Gate HTTP Location RIG Exploit Kit Decoy Gate Motors Campaign Decoy Rulan Campaign Rulan Campaign Rulan Campaign Exploit Kit Adobe Flash Player StarC Exploit Kit Rulan Campaign 3.12 Rulan Campaign Exploit Kit Rulan Campaign Gate HTTP Location RIG Exploit Kit Gate IP

3.11 Motors Campaign Decoy 3.12 StarC Exploit Kit Rulan Campaign red.ru Adobe Flash Player Rulan Campaign 3.13 3.

15 3.11 Motors Campaign Decoy 3.12 StarC Exploit Kit Rulan Campaign red.ru Adobe Flash Player Rulan Campaign StarC Adobe Flash Player Rulan Campaign Adobe Flash Player Rulan Campaign Gate 3.14 Adobe Flash Player ZIP ZIP JavaScript Gate flash.ru 13

16 3.14 Adobe Flash Player Seamless Campaign Seamless Campaign RIG Exploit Kit Malvertising StarC Seamless Campaign StarC Seamless Campaign Seamless Campaign Pre-Gate Gate Pre-Gate 3.16 JavaScript Web Gate RIG Exploit Kit iframe Web Pre-Gate Gate Pre-Gate /japan Pre-Gate Pre-Gate Gate 1 Pre-Gate Gate 14

17 3.16 Seamless Campaign JavaScript 3.3 (3) RIG Exploit Kit RIG Exploit Kit IP RIG Exploit Kit 2 HTTP Location Web RIG Exploit Kit Exploit Kit RIG Exploit Kit 3.17 RIG Exploit Kit HTTP Location HTTP IP 2 RIG Exploit Kit 15

3.18 2 HTTP 3.9 Seamless URL http://194.58.38.31/signup1.php http://194.58.38.50/signup1.php http://194.58.38.51/signup1.php http://194.58.39.179/signup1.php http://194.58.46.209/signup1.

18 HTTP 3.9 Seamless URL RIG Exploit Kit 10 RIG Exploit Kit URL Seamless Seamless URL UTC 6 18 RIG Exploit Kit 9 UTC (4) RIG Exploit Kit IP RIG Exploit Kit IP Web RIG Exploit Kit 16

19 3.19 RIG Exploit Kit RIG Exploit Kit IP xx.xx xx.xx RIG Exploit Kit URL Seamless xx.xx xx.xx RIG Exploit Kit RIG Exploit Kit RIG Exploit Kit RIG Exploit Kit JavaScript Drive-by Download xx.xx xx.xx xx.xx RIG Exploit Kit xx.xx RIG Exploit Kit IP RIG Exploit Kit 3.5 RIG Exploit Kit Drive-by Download IP RIG Exploit Kit 17

20 RIG Exploit Kit 18

21 3.22 RIG Exploit Kit 19

22 4 RIG Exploit Kit RIG Exploit Kit 1 IP 12 RIG Exploit Kit IP RIG Exploit Kit RIG Exploit Kit IP RIG Exploit Kit Exploit Kit 20

23 21

24 [1] NTT ( v ) [2] RIG-EK ( rigek.html ) [3] ( ) [4] LAC CYBER GRID VIEW Vol.3 RIG Exploit Kit ( cgview vol3 f001t.pdf ) [5] RSA SHADOWFALL ( ) [6] RIG Exploit Kit [7] Exploit Kit Web 2013 pp [8] NTT RIG ( ) 22

2.3 1 RIG Exploit Kit (4) 4 Exploit Kit 2.2 RIG Exploit Kit RIG Exploit Kit 1 5 (1) Web Web (2) RIG Exploit Kit URL (3) URL iframe RIG Exploit Kit (4)

2.3 1 RIG Exploit Kit (4) 4 Exploit Kit 2.2 RIG Exploit Kit RIG Exploit Kit 1 5 (1) Web Web (2) RIG Exploit Kit URL (3) URL iframe RIG Exploit Kit (4) StarC Drive-by Download 1 2017 4 Web Web Drive-by Download [1] Driveby Download Web Web Web Drive-by Download Exploit Kit Exploit Kit Web Exploit Kit Drive-by Download Exploit Kit RIG Exploit Kit [2][3][4]