Analysis of password-strength page at unwrongest website (split from password thread)

Also used FF







Hope he gets it sorted soon.

You're right to question, i've clarified this post

 

Well there's no need for people to merrily click away oblivious of the consequences.

 

Thanks for the reply. I figured it was, but still thought it wise to check with others.

 

I don't have Adobe Reader either, but you know the warnings I have been getting. I think you seeing nothing is more a function of the malware being based on geoIP, as Vlk stated.

 

I agree. I know I have learned quite a bit, on many levels, as you noted.

 

While this seems very sophisticated, it's really just another plateau in the evolution of complex malware that began at least five years ago.

Back then, security analysts used the term "unicode" for obfuscating (disquising) the real code:

Hackers, Scammers Hide Malicious JavaScript On Web Sites
October 20, 2005 02:45 PM
http://www.informationweek.com/news/security/cybercrime/showArticle.jhtml?articleID=172302840

Here is an example from that time:

http://www.urs2.net/rsj/computing/tests/postcards/

One of the HTML files that is cached selects the exploit based on the version of Windows and the IE browser. The actual code:

Code:

// launching exploit which number is depends on Windows and IE versions
function Get_Win_Version(IE_vers)
   
     if (IE_vers.indexOf('Windows 95') != -1) return "95"
     else if (IE_vers.indexOf('Windows NT 4') != -1) return "NT"
     else if (IE_vers.indexOf('Win 9x 4.9') != -1) return "ME"
     else if (IE_vers.indexOf('Windows 98') != -1) return "98"
     else if (IE_vers.indexOf('Windows NT 5.0') != -1) return "2K"
     else if (IE_vers.indexOf('Windows NT 5.1') != -1) return "XP"
     else if (IE_vers.indexOf('Windows NT 5.2') != -1) return "2K3"

This is a forerunner of the Exploit Kit which serves up malware to exploit vulnerabilities in different browsers and other applications.

Postcards even checks for the presence of certain AV:

Code:

 if ((fNortonAV==0)&&(fMcAfee==0))
 { ExploitNumber=3; } 
     else
     { ExploitNumber=2; }

I mention a bit of history because it's easy to get caught up in the sensational aspects of remote code execution attacks and lose sight of the easy ways these attacks are thwarted from running their executable payloads.

I mentioned in a previous TDSS thread that for all of the sophistication of malware exploits, they still depend on the 2 tried and proven methods of attack. Marco of Prevx responds.

https://www.wilderssecurity.com/showthread.php?t=265297

So, no matter the sophistication of the code, it still has to get a malware executable onto the system.

----
rich