Hackers can use Adblock Plus filters for storage of malware code

In popular advertisement blocker Adblock Plus is found vulnerability that allows organization of JavaScript-code performance.

JS-code can be executed in case of usage unchecked filter, adopted by intruders (Zum Beispiel, while connection to list side rules or through the substitution of rules in MITM-attack).

Authors of lists with filter sets can organize performance of their code in context of web-sites that user opens through adding lines with “rewrite” operator that makes substitution of URL-part. Rewrite operator does not enable substituting of a host in URL though allows freely manipulate with inquiry arguments. Substitution by tags as script, object and subdocument is blocked but text can be used for replacement.

Dennoch, code performance can be achieve another way. Some websites, einschließlich Google Maps, Google Mail und Google Images, apply technique of dynamic JavaScript-blocks download that is transited in a form of naked text. Except hosts that enables redirecting, attack can also be accomplished against services that allows users’ content accommodation.

Suggested method involves only pages that dynamically download lines with JavaScript code and then perform them. Another important limitation is necessity of redirect using or placement of random data on a page of initial server that gives resource.

Fixing of an issue is on a preparatory stage. Adblock and uBlock also encounter this problem.

Adblock Plus developers assess possibility of real attacks as low as they censor all changes in service rules list and seldom practice connection of side lists.

Quelle: www.adblockplus.org/blog

Über Trojan Mörder

Tragen Sie Trojan Killer-Portable auf Ihrem Memory-Stick. Achten Sie darauf, dass Sie in der Lage sind, Ihr PC keine Cyber-Bedrohungen widerstehen zu helfen, wo immer Sie sind.

überprüfen Sie auch

MageCart auf der Heroku Cloud Platform

Die Forscher fanden mehrere MageCart Web Skimmer Auf Heroku Cloud Platform

Forscher an Malwarebytes berichteten über mehr MageCart Web-Skimmer auf der Heroku Cloud-Plattform zu finden, …

Android Spyware CallerSpy

CallerSpy Spyware Masken als Android-Chat-Anwendung

Trend Micro Experten entdeckt die Malware CallerSpy, die Masken als Android-Chat-Anwendung, und, …

Hinterlasse eine Antwort