Fake Ad Blocker Capable of Running Arbitrary code on Windows Systems

0
13KB

ESET specialists have discovered an advertising malware that is distributed under the guise of an ad blocker. The malware silently loads a kernel driver component, allowing attackers to run arbitrary code with elevated privileges on Windows hosts.

The malware, dubbed HotPage (from the HotPage.exe installer of the same name), has been active since the end of 2023. The exact distribution method of the malware installer is unknown, but it appears to be being advertised as a security solution for internet cafes designed to improve web browsing and block ads.

 
The researchers say that this installer deploys a driver capable of injecting code into remote processes, as well as two libraries capable of intercepting and interfering with network traffic from browsers.

"As a result, the malware is capable of modifying and replacing the content of the requested page, redirecting the user to another page, or opening a new page in a new tab based on certain criteria," the experts write.
In addition to its ability to intercept and filter traffic to display unwanted ads (mainly related to games), the malware is designed to collect and steal system information. The collected data is transmitted to a remote server associated with the Chinese company Hubei Dunwang Network Technology Co., Ltd (湖北盾网网络科技有限公司).

This is done by using a driver whose primary purpose is to inject libraries into browser applications and modify the process of running them (for the sake of spoofing URLs and redirecting browsers' home pages to a specific URL specified in the settings).

Moreover, the lack of an ACL (Access Control List) for this driver allowed attackers with an unprivileged account to gain elevated privileges and run code with System-level privileges.

"This kernel component inadvertently opens the door to threats related to the execution of code with the highest level of privilege in the Windows operating system: the System account. Due to incorrectly implemented restrictions of this kernel component, an attacker with an unprivileged account could gain elevated privileges and run code on behalf of the NT AUTHORITY\System account," ESET warns.
Also, the mentioned driver is notable for the fact that it is signed by Microsoft. It is assumed that the Chinese company was able to pass Microsoft checks and received an Extended Verification (EV) certificate. It was removed from the Windows Server Catalog only on May 1, 2024, after a warning from researchers.

Rechercher
Catégories
Lire la suite
Business
What Advice Would You Give to Aspiring Managers?
Stepping into a management role is an exciting milestone, but it also brings a new set of...
Par Dacey Rankins 2025-05-14 14:12:44 0 4KB
Television
FOX 10 Live TV from Phoenix USA
Raw & unfiltered. Watch a non-stop stream of breaking news, live events and stories across...
Par Nikolai Pokryshkin 2022-09-08 09:14:15 0 44KB
Ужасы
Время. Old. (2021)
Отправившись в отпуск на тропический остров, семья с двумя детьми решает последовать совету...
Par Nikolai Pokryshkin 2022-09-11 22:13:06 0 36KB
Television
Revelation Live TV. United Kingdom.
Our Mission is to use Media to strengthen the Christian voice and impact the nations, with the...
Par Nikolai Pokryshkin 2022-11-28 18:16:17 0 30KB
Internet Broadcasts
The Rise of Internet Broadcasts: Transforming Media and Communication
The internet has revolutionized the way we communicate, access information, and entertain...
Par Dacey Rankins 2024-12-09 14:04:38 0 8KB

BigMoney.VIP Powered by Hosting Pokrov



Top sites Pokrov