'SocGholish' Attack Framework Powers Surge in Drive-By Attacks

guest · Dec 18, 2020

'SocGholish' Attack Framework Powers Surge in Drive-By Attacks
December 17, 2020
https://www.darkreading.com/attacks...wers-surge-in-drive-by-attacks/d/d-id/1339762

Drive-by download attacks have been on the uptick over the past two months, thanks to a highly active attack framework that security researchers have dubbed "SocGholish" for its ample use of social engineering tools and techniques.

SocGholish impersonates legitimate browser, Flash, and Microsoft Teams updates to trick users into executing malicious ZIP files that are automatically placed on their machines when a visit to an infected compromise triggers a drive-by download.
SocGholish attackers host and serve the malicious downloads by leveraging iFrames to serve up compromised websites via a legitimate website.

"Because the file is hosted in an iframe within a legitimate site, users are tricked into thinking the file is from a legitimate source and encouraged to download and execute the file," said Krishnan Subramanian, security researcher at Menlo Security, in a research note today.
Click to expand...

The drive-by download mechanisms used by the SocGholish framework don't involve browser exploitations or exploit kits to deliver payloads.

Instead, it uses three main techniques. The first is using watering hole attacks by planting iFrames on sites with relatively high Alexa rankings and then sending users through a number of redirects [...]
The second technique is compromising sites hosted on content management systems like WordPress to embed iFrames that use JavaScript blobs to trigger the download.

The third SocGholish technique is leveraging sites.google.com and JavaScript to dynamically create a download link element pointed to a ZIP file hosted on a legitimate Google Drive link, and then simulating a click to trigger the download.
Click to expand...

Menlo Security: Increase In Attack: SocGholish

User interaction is still required to extract and execute the contents inside the malicious ZIP file, but this is where social engineering and trust from the source of the file comes in.
Because the file is hosted in an iframe within a legitimate site, users are tricked into thinking the file is from a legitimate source and encouraged to download and execute the file.
Click to expand...

A Note on Browser Security Controls around iframes
Recently, Chrome and Firefox developers have added a security feature that automatically blocks downloads from sandboxed iframes. In the above techniques, downloads were allowed from iframes specified by the following settings:

Injected iframe without the “sandbox” attribute specified, which would just allow downloads from iframe.

The sites.google.com example has an iframe with the “sandbox” attribute, but also has the “allow-downloads”, “allow-scripts”, “allow-forms”, etc. set.

Click to expand...

Log in or Sign up

'SocGholish' Attack Framework Powers Surge in Drive-By Attacks

guest Guest

Log in or Sign up

'SocGholish' Attack Framework Powers Surge in Drive-By Attacks

guest Guest

Useful Searches