Fake Ad Blocker Capable of Running Arbitrary code on Windows Systems

0
12K

ESET specialists have discovered an advertising malware that is distributed under the guise of an ad blocker. The malware silently loads a kernel driver component, allowing attackers to run arbitrary code with elevated privileges on Windows hosts.

The malware, dubbed HotPage (from the HotPage.exe installer of the same name), has been active since the end of 2023. The exact distribution method of the malware installer is unknown, but it appears to be being advertised as a security solution for internet cafes designed to improve web browsing and block ads.

 
The researchers say that this installer deploys a driver capable of injecting code into remote processes, as well as two libraries capable of intercepting and interfering with network traffic from browsers.

"As a result, the malware is capable of modifying and replacing the content of the requested page, redirecting the user to another page, or opening a new page in a new tab based on certain criteria," the experts write.
In addition to its ability to intercept and filter traffic to display unwanted ads (mainly related to games), the malware is designed to collect and steal system information. The collected data is transmitted to a remote server associated with the Chinese company Hubei Dunwang Network Technology Co., Ltd (湖北盾网网络科技有限公司).

This is done by using a driver whose primary purpose is to inject libraries into browser applications and modify the process of running them (for the sake of spoofing URLs and redirecting browsers' home pages to a specific URL specified in the settings).

Moreover, the lack of an ACL (Access Control List) for this driver allowed attackers with an unprivileged account to gain elevated privileges and run code with System-level privileges.

"This kernel component inadvertently opens the door to threats related to the execution of code with the highest level of privilege in the Windows operating system: the System account. Due to incorrectly implemented restrictions of this kernel component, an attacker with an unprivileged account could gain elevated privileges and run code on behalf of the NT AUTHORITY\System account," ESET warns.
Also, the mentioned driver is notable for the fact that it is signed by Microsoft. It is assumed that the Chinese company was able to pass Microsoft checks and received an Extended Verification (EV) certificate. It was removed from the Windows Server Catalog only on May 1, 2024, after a warning from researchers.

Site içinde arama yapın
Kategoriler
Read More
Philanthropy
Understanding Philanthropy: The Art of Giving Back
Understanding Philanthropy: The Art of Giving Back In a world often marked by division and...
By Leonard Pokrovski 2024-06-11 23:14:47 0 13K
Humanities
ETHNO-ART AS AN ACTUAL DIRECTION IN THE MODERN HUMANITIES
According to the concept common in the postmodern theory of art, the future is not in national...
By FWhoop Xelqua 2022-12-03 17:18:43 0 17K
Personal Finance
Moody's downgrades Israel's credit rating
The international rating agency Moody's has downgraded Israel's credit rating by two notches at...
By Dacey Rankins 2024-10-23 16:20:52 0 18K
Социальные проблемы
Пианист. The Pianist. (2002)
Фильм снят по автобиографии Владислава Шпильмана, одного из лучших пианистов Польши 30-х годов...
By Nikolai Pokryshkin 2022-11-25 18:25:22 0 26K
Software
Unraveling the Science Behind Software: Bridging the Gap Between Logic and Creativity
Unraveling the Science Behind Software: Bridging the Gap Between Logic and Creativity In the...
By Leonard Pokrovski 2024-05-27 22:10:35 0 16K
image/svg+xml


BigMoney.VIP Powered by Hosting Pokrov