Stegano campaign exposed millions netizens via script in pixels of ads
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-0162 | Information Disclosure via JavaScript File Detection in Microsoft Internet Explorer CVE-2016-0162 is an information disclosure flaw (CWE-200) in Microsoft Internet Explorer caused by improper handling of JavaScript, which can allow an attacker to detect the presence of specific files on a user's computer. It is triggered when Internet Explorer processes attacker-controlled JavaScript, typically when a user views a crafted webpage or embedded web content. What the attacker gains is reconnaissance value rather than code execution: confirmation that named files exist on the victim's machine, which can be used to tailor more targeted follow-on attacks. Any user running the affected Internet Explorer versions is potentially exposed, although the source data does not enumerate specific version ranges beyond 'Microsoft Internet Explorer.' The flaw was added to CISA's Known Exploited Vulnerability (KEV) catalog on 2022-05-24, confirming exploitation in the wild; EPSS estimates a 22.1% probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known. Do: Apply Microsoft security updates for Internet Explorer per vendor instructions, prioritizing user workstations and any internet-facing systems where IE is in use, and treat this as a patch-now item given the KEV listing. Verify that IE builds are current against Microsoft's cumulative IE security updates, since the source data does not list specific fixed versions. Where feasible, reduce attack surface by steering users to supported modern browsers or restricting legacy IE to trusted sites; CISA lists ransomware association as unknown, so confirm whether your threat intel ties this CVE to known campaigns. | 4.3 | 22% | KEV |
| masshundreds of millions of users (IE historically shipped by default on Windows; exact counts of unpatched installs unknown) |
Full article444 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 07, 2016
Stegano campaign – Millions of people visiting major websites may have been infected with malicious code that was embedded in pixels of the ads banners.
A single pixel could be used to compromise your PC, millions of people visiting major websites over the past months may have been infected with malicious code that was embedded in pixels of the ads banners.
The malware researchers from security firm ESET dubbed this malvertising campaign ‘Stegano,’ despite it dates back to 2014, since October threat actors started using the technique via ads displayed on many high-reputable news sites. each with millions of daily visitors.
According to the company, millions of daily visitors may have been exposed to the Stegano campaign.
The experts discovered that Stegano hides portions of its malicious code in parameters controlling the transparency of pixels used to display banner ads, but the impact of the appearance of the images is almost imperceptible.
“The malicious version of the graphic has a script encoded in its alpha channel, which defines the transparency of each pixel. Since the modification is minor, the final picture’s color tone is only slightly different to that of the clean version” reads the analysis published by the company-
The researchers discovered that the code first checks for the presence of a virtualized environment,sandboxing mechanisms, or security software, then redirects the victim’s browser to a site that hosts three exploits for Adobe Flash vulnerabilities. The script targets users who visited the news sites with Internet Explorer browsers, it leverages on the CVE-2016-0162 exploitation.
“We can say that even some of the other major exploit kits, like Angler and Neutrino, are outclassed by the Stegano kit in terms of referrals—the websites onto which they managed to get the malicious banners installed,” contines the analysis. “We have observed major domains, including news websites visited by millions of people every day, acting as ‘referrers’ hosting these advertisements. Upon hitting the advertising slot, the browser will display an ordinary-looking banner to the observer. There is, however, a lot more to it than advertising.”
The exploit is used by crooks to a malicious code belonging to the families of malware known as Ursnif family (banking trojan and data stealer) and the popular Ramnit malware.
The infections were concentrated in Canada, the UK, Australia, Spain, and Italy because its users used to visit the websites affected by the malvertising campaign.
In order to avoid being victims of the Stegano kit, or any other known exploit kit in the threat landscape, netizens have to use up to date software and security solutions.
[adrotate banner=”9″]
(Security Affairs – Stegano kit, malware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/54141/cyber-crime/stegano-campaign-pixel.html