Fake Ad Blocker Capable of Running Arbitrary code on Windows Systems

0
12KB

ESET specialists have discovered an advertising malware that is distributed under the guise of an ad blocker. The malware silently loads a kernel driver component, allowing attackers to run arbitrary code with elevated privileges on Windows hosts.

The malware, dubbed HotPage (from the HotPage.exe installer of the same name), has been active since the end of 2023. The exact distribution method of the malware installer is unknown, but it appears to be being advertised as a security solution for internet cafes designed to improve web browsing and block ads.

 
The researchers say that this installer deploys a driver capable of injecting code into remote processes, as well as two libraries capable of intercepting and interfering with network traffic from browsers.

"As a result, the malware is capable of modifying and replacing the content of the requested page, redirecting the user to another page, or opening a new page in a new tab based on certain criteria," the experts write.
In addition to its ability to intercept and filter traffic to display unwanted ads (mainly related to games), the malware is designed to collect and steal system information. The collected data is transmitted to a remote server associated with the Chinese company Hubei Dunwang Network Technology Co., Ltd (湖北盾网网络科技有限公司).

This is done by using a driver whose primary purpose is to inject libraries into browser applications and modify the process of running them (for the sake of spoofing URLs and redirecting browsers' home pages to a specific URL specified in the settings).

Moreover, the lack of an ACL (Access Control List) for this driver allowed attackers with an unprivileged account to gain elevated privileges and run code with System-level privileges.

"This kernel component inadvertently opens the door to threats related to the execution of code with the highest level of privilege in the Windows operating system: the System account. Due to incorrectly implemented restrictions of this kernel component, an attacker with an unprivileged account could gain elevated privileges and run code on behalf of the NT AUTHORITY\System account," ESET warns.
Also, the mentioned driver is notable for the fact that it is signed by Microsoft. It is assumed that the Chinese company was able to pass Microsoft checks and received an Extended Verification (EV) certificate. It was removed from the Windows Server Catalog only on May 1, 2024, after a warning from researchers.

Pesquisar
Categorias
Leia mais
College and University
Navigating Higher Education: A Guide to College and University
Navigating Higher Education: A Guide to College and University In the journey of personal and...
Por Leonard Pokrovski 2024-06-18 20:58:46 0 19KB
Business
What Are Some Famous Startup Success Stories?
Every billion-dollar company once started as an idea—sometimes in a dorm room, a garage, or...
Por Dacey Rankins 2025-04-11 17:02:14 0 4KB
Stories
13th (2016)
An in-depth look at the prison system in the United States and how it reveals the nation's...
Por Leonard Pokrovski 2023-07-11 20:31:04 0 23KB
Business
What Is the CEO's Background and Experience?
When evaluating a startup, one of the first areas of focus for potential investors, employees,...
Por Dacey Rankins 2025-05-02 15:06:42 0 4KB
Magazines and E-zines
Exploring the Evolution of News Consumption: Magazines and E-zines
In an age of rapid digital transformation, the way we consume news has undergone a significant...
Por Dacey Rankins 2024-05-06 16:03:45 0 12KB
image/svg+xml


BigMoney.VIP Powered by Hosting Pokrov