Hackers can use Adblock Plus filters for storage of malware code

In popular advertisement blocker Adblock Plus is found vulnerability that allows organization of JavaScript-code performance.

JS-code can be executed in case of usage unchecked filter, adopted by intruders (For eksempel, while connection to list side rules or through the substitution of rules in MITM-attack).

Authors of lists with filter sets can organize performance of their code in context of web-sites that user opens through adding lines with “rewrite” operator that makes substitution of URL-part. Rewrite operator does not enable substituting of a host in URL though allows freely manipulate with inquiry arguments. Substitution by tags as script, object and subdocument is blocked but text can be used for replacement.

likevel, code performance can be achieve another way. Some websites, gjelder også Google Maps, Gmail Og Google Images, apply technique of dynamic JavaScript-blocks download that is transited in a form of naked text. Except hosts that enables redirecting, attack can also be accomplished against services that allows users’ content accommodation.

Suggested method involves only pages that dynamically download lines with JavaScript code and then perform them. Another important limitation is necessity of redirect using or placement of random data on a page of initial server that gives resource.

Fixing of an issue is on a preparatory stage. Adblock and uBlock also encounter this problem.

Adblock Plus developers assess possibility of real attacks as low as they censor all changes in service rules list and seldom practice connection of side lists.

Kilde: www.adblockplus.org/blog

Om Trojan Killer

Carry Trojan Killer Portable på minnepinne. Vær sikker på at du er i stand til å hjelpe din PC motstå eventuelle cyber trusler uansett hvor du går.

Sjekk også

MageCart på Heroku Cloud Platform

Forskere fant flere MageCart Web Skimmers På Heroku Cloud Platform

Forskere ved Malwarebytes rapportert om å finne flere MageCart web skimmere på Heroku Cloud Platform …

Android spyware CallerSpy

CallerSpy spyware masker som en Android-chat program

Trend Micro eksperter oppdaget malware CallerSpy, som masker som en Android-chat program og, …

Legg igjen et svar