Home » News » Hackers can use Adblock Plus filters for storage of malware code

Hackers can use Adblock Plus filters for storage of malware code

In popular advertisement blocker Adblock Plus is found vulnerability that allows organization of JavaScript-code performance.

JS-code can be executed in case of usage unchecked filter, adopted by intruders (for instance, while connection to list side rules or through the substitution of rules in MITM-attack).

Authors of lists with filter sets can organize performance of their code in context of web-sites that user opens through adding lines with “rewrite” operator that makes substitution of URL-part. Rewrite operator does not enable substituting of a host in URL though allows freely manipulate with inquiry arguments. Substitution by tags as script, object and subdocument is blocked but text can be used for replacement.

Nevertheless, code performance can be achieve another way. Some websites, including Google Maps, Gmail and Google Images, apply technique of dynamic JavaScript-blocks download that is transited in a form of naked text. Except hosts that enables redirecting, attack can also be accomplished against services that allows users’ content accommodation.

Suggested method involves only pages that dynamically download lines with JavaScript code and then perform them. Another important limitation is necessity of redirect using or placement of random data on a page of initial server that gives resource.

Fixing of an issue is on a preparatory stage. Adblock and uBlock also encounter this problem.

Adblock Plus developers assess possibility of real attacks as low as they censor all changes in service rules list and seldom practice connection of side lists.

Source: www.adblockplus.org/blog

[Total: 1    Average: 5/5]
READ  Microsoft IE11 vulnerability is more dangerous than it seemed as browser Edge is also sensitive to it

About Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.

Check Also

DNSpionage

Cybercriminals that conducted DNSpoinage campaign, armed now with new malware software

Cybercriminal group that is responsible for DNSpionage operation became more selective in choosing victims and …

Russian hackers

Russian-speaking cybercriminals committed a series of fishing attacks on embassies of European counties.

Cybercriminals attacked embassies of European countries in Italia, Liberia, Kenia and other countries after sending …

Leave a Reply