Attackers Distributing Malware Under Guise of Security Certificate Updates

Cybercriminals can be an innovative bunch when it comes to finding new ways to distribute malware.

The latest example is a new campaign involving the use of a fake digital certificate "update" to try and infect systems of visitors to previously compromised websites.

Security vendor Kaspersky on Thursday reported that its researchers had recently observed visitors to various websites being greeted with a warning about the site's security certificate having expired and being invited to download an updated one instead. Users who fell for the lure ended up downloading malware on their systems.

The campaign appears to have started around mid-January and impacted visitors to several websites, including one belonging to a zoo and another to an auto parts dealer. Kaspersky said it is not immediately clear how exactly the attackers behind the campaign might have initially infected these sites.

According to Kaspersky, the campaign is the first one its researchers have encountered where attackers are attempting to distribute malware in the guise of a website security update. The method is a slight twist on an approach that attackers have employed for a long time of hiding malware in fake software and browser updates and Adobe Flash installs. Attackers have planted such updates on legitimate sites and tried to trick users into downloading them under various pretexts — or they have tricked them to navigating to sites hosting the malicious updates.

"People are particularly susceptible to this type of attack because it appears on legitimate websites — ones they've possibly already visited," says Victoria Vlasova, a malware analyst at Kaspersky.

In the latest campaign, users to infected websites are greeted with a notification through an iframe about the site's security certificate being out of date. The contents of the iframe are from a third-party resource and are simply overlaid on top of the original page. As a result, the URL bar still displays the legitimate address of the compromised website, Kaspersky said in a report. The iframe overlay is also exactly the same size as the page so users wouldn't have an easy way to proceed to the site if they chose to ignore the fake notification.

Because the address listed in the iframe is, in fact, the real address of the website, the natural instinct for users is to install the recommended certificate so they can view the content they want to, Vlasova says. "However, users should always be wary when prompted to download something by an online source," she adds. "Chances are, it's not necessary.”

Campaign Being Used to Distribute Mokes & Buerak Malware
In the new campaign that Kaspersky observed, attackers are distributing Mokes and Buerak, two previously known pieces of malware, under the guise of a security certificate update.

Mokes is a backdoor from several years ago that can be used to download other malware, steal credentials, and intercept data that users might enter into a Web form. The malware, referred to by some as "Smoke Loader," can also be used to install shell code on an infected computer, according to Kaspersky. Buerak has similar functionality and can be used to spread other malware, including crypto-mining software, ransomware, remote access Trojans, and keyloggers.

"As incidents involving certificate issuance and deployment become more well-known and mainstream, attackers have one more avenue to use in creating attacks that leverage social engineering efforts" said Pratik Savla, senior security engineer at Venafi. "Unfortunately, and also unsurprisingly, we are bound to see an uptick of this kind of campaign."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "The Perfect Travel Security Policy for a Globe-Trotting Laptop."