Fake Ad Blocker Capable of Running Arbitrary code on Windows Systems

0
14K

ESET specialists have discovered an advertising malware that is distributed under the guise of an ad blocker. The malware silently loads a kernel driver component, allowing attackers to run arbitrary code with elevated privileges on Windows hosts.

The malware, dubbed HotPage (from the HotPage.exe installer of the same name), has been active since the end of 2023. The exact distribution method of the malware installer is unknown, but it appears to be being advertised as a security solution for internet cafes designed to improve web browsing and block ads.

 
The researchers say that this installer deploys a driver capable of injecting code into remote processes, as well as two libraries capable of intercepting and interfering with network traffic from browsers.

"As a result, the malware is capable of modifying and replacing the content of the requested page, redirecting the user to another page, or opening a new page in a new tab based on certain criteria," the experts write.
In addition to its ability to intercept and filter traffic to display unwanted ads (mainly related to games), the malware is designed to collect and steal system information. The collected data is transmitted to a remote server associated with the Chinese company Hubei Dunwang Network Technology Co., Ltd (湖北盾网网络科技有限公司).

This is done by using a driver whose primary purpose is to inject libraries into browser applications and modify the process of running them (for the sake of spoofing URLs and redirecting browsers' home pages to a specific URL specified in the settings).

Moreover, the lack of an ACL (Access Control List) for this driver allowed attackers with an unprivileged account to gain elevated privileges and run code with System-level privileges.

"This kernel component inadvertently opens the door to threats related to the execution of code with the highest level of privilege in the Windows operating system: the System account. Due to incorrectly implemented restrictions of this kernel component, an attacker with an unprivileged account could gain elevated privileges and run code on behalf of the NT AUTHORITY\System account," ESET warns.
Also, the mentioned driver is notable for the fact that it is signed by Microsoft. It is assumed that the Chinese company was able to pass Microsoft checks and received an Extended Verification (EV) certificate. It was removed from the Windows Server Catalog only on May 1, 2024, after a warning from researchers.

Site içinde arama yapın
Kategoriler
Read More
Humanities
Art Humanities: Exploring the Intersection of Creativity, Culture, and Critical Thought
The term Art Humanities encompasses a broad range of academic disciplines that study the human...
By Dacey Rankins 2024-11-07 16:43:14 0 13K
Science in Society
Science in Society: Bridging Knowledge and Progress
Science is more than just a field of study—it is a cornerstone of modern society, shaping...
By Dacey Rankins 2024-11-15 14:54:33 0 10K
Business
What Role Does Corporate Governance Play in Late-Stage Startups?
As startups grow into mature businesses, they face new challenges that require strong corporate...
By Dacey Rankins 2025-03-06 18:31:35 0 7K
Business
How Should I Handle Sensitive Topics or Cultural Differences in Feedback?
Giving feedback is a vital part of leadership, growth, and collaboration—but when it...
By Dacey Rankins 2025-07-24 18:10:56 0 3K
Искусство, культура и развлечения
Шерлок младший. Sherlock Jr. (1924)
Б.Китон - киномеханик, который мечтает быть знаменитым детективом, как Шерлок Холмс. Влюбленный в...
By Nikolai Pokryshkin 2023-04-02 21:01:16 0 39K

BigMoney.VIP Powered by Hosting Pokrov