Analyzing and Detecting Malicious Flash Advertisements
Total Page:16
File Type:pdf, Size:1020Kb
Analyzing and Detecting Malicious Flash Advertisements Sean Ford, Marco Cova, Christopher Kruegel, and Giovanni Vigna Department of Computer Science University of California, Santa Barbara Santa Barbara, United States fodo,marco,chris,[email protected] Abstract—The amount of dynamic content on the web has the Adobe Flash Player (CVE-2006-3311, CVE-2007-0071, been steadily increasing. Scripting languages such as JavaScript CVE-2007-6019, CVE-2008-5499, CVE-2009-0520, CVE- and browser extensions such as Adobe’s Flash have been 2009-1866) that could possibly be exploited by attackers instrumental in creating web-based interfaces that are similar to those of traditional applications. Dynamic content has also to execute arbitrary code. In addition, Flash can be used become popular in advertising, where Flash is used to create to forcibly direct victims to sites that host phishing and rich, interactive ads that are displayed on hundreds of millions drive-by download attacks. Therefore, it is not surprising of computers per day. Unfortunately, the success of Flash- that criminals started to distribute malicious Flash adver- based advertisements and applications attracted the attention tisements, often known as “malvertisements.” of malware authors, who started to leverage Flash to deliver attacks through advertising networks. This paper presents a Typically, malvertisements are used to download and novel approach whose goal is to automate the analysis of install malware on a victim’s machine. This malware turns Flash content to identify malicious behavior. We designed and the compromised machine into a member of a botnet, which implemented a tool based on the approach, and we tested it on is then used to send spam, execute denial of service attacks, a large corpus of real-world Flash advertisements. The results or steal sensitive user information [3]. Malicious Flash show that our tool is able to reliably detect malicious Flash ads with limited false positives. We made our tool available advertisements use a plethora of tricks to evade detection, publicly and it is routinely used by thousands of users. and, as a result, they continuously make their way onto live advertising networks, where they have the potential to infect millions of users. I. INTRODUCTION Manually examining Flash advertisements for malicious Adobe Flash has had an enormous impact on the growth behavior is infeasible given the volume of advertisements of the web in recent years. Sites such as YouTube use it that are produced, and current publicly-available tools to to serve hundreds of millions of videos to users daily [1], analyze Flash malicious content are unfortunately not suffi- and the versatility of Flash has even been utilized to create cient. As a consequence, malicious Flash advertisements are full motion pictures such as Waltz with Bashir. Flash was routinely distributed. In April 2009, nine incidents of Flash- created by Macromedia in 1996 to ease the creation of based malicious advertisements affected major web sites animation on the web. Later, advanced scripting capabilities such as guardian.co.uk and perezhilton.com (both appear on were added, making it a flexible environment to run exter- the Alexa Top 500 Global Sites list.) [4] [5] nal code on client computers and create dynamic content. The current situation motivates the need for improved The Flash scripting language, called ActionScript, is an techniques to identify malicious Flash applications, and, in ECMAScript-compliant language, which makes it closely particular, advertisements. This paper describes our work related to JavaScript. on a system to detect malicious Flash advertisements and One of the areas where Flash has gained popularity is the other Flash-based exploits. Our approach uses a combination display of advertisements. Flash provides advertisers with of dynamic and static analysis to determine the malicious the ability to create ads with full animation, sound, and the nature of a Flash file, instead of relying purely on static ability to interact with the user. Moreover, advertisers are signatures. Our contributions are: assured that their Flash advertisements will be accessible to • We performed an in-depth analysis of the characteristics a large audience due to Flash’s market penetration of nearly and inner workings of malicious Flash advertisements; 99% [2]. This popularity, unfortunately, makes Flash also a • We designed a system, called OdoSwiff, to detect worthwhile target when it comes to malicious attacks on the malicious Flash advertisements and applications; Internet. Numerous vulnerabilities have been discovered in • We conducted a preliminary study to quantify how Table I: Flash, ActionScript and ActionScript Virtual Ma- !"#$%&'(#)(* +#,-.&/012(*3&-$4516*($$()3&7(*$-583&!-"(&9-:(& chine versions. Flash Version 5 6 7 8 9 10 ;#,<&=;>6(?&=9-:(?&=@-8#*>&)#A#? ActionScript 1.0 2.0 3.0 Virtual Machine 1 2 ;#,<&=;>6(?&=9-:(?&=@-8#*>&)#A#? static function search(searchTerm) ;#,<&=;>6(?&=9-:(?&=@-8#*>&)#A#? { var searchURL = "http://www" + ".google.com/search?q="; getURL(searchURL ;#,<&=;>6(?&=9-:(?&=@-8#*>&)#A#? + searchTerm,"_target"); } function (reg2=’searchTerm’) (reg1=’this’) ;#,<&=;>6(?&=9-:(?&=@-8#*>&)#A#? push ’http://www.google.com/search?q=’ setRegister reg3 pop push reg3, r:searchTerm add Figure 1: Example Flash file structure. push ’_target’ getURL2 end widespread the problem of malicious Flash advertise- Figure 2: An example ActionScript 2.0 function with the ments is by crawling the Internet looking for malicious corresponding ActionScript bytecode instructions, called ac- behavior. tions. The rest of this paper is structured as follows. In Section II we present an overview of Flash-based malware. Then, in Section III we provide a description of our system to detect creating a fully interactive Flash application. In particular, malicious Flash applications and advertisements. Section IV these tags contain a list of actions, where each action is an contains an evaluation of our tool. Then, Section V discusses operation in ActionScript bytecode. ActionScript bytecode is related work. Finally, Section VI briefly concludes. a stack-based language, and actions range from simple stack operations like push, pop, and mathematical operations, to II. FLASH BASED MALWARE more complex actions such as method creation and invoca- Adobe Flash files (often called swiff files due to their tion, URL requests, etc. A virtual machine contained within .swf file extension) use a binary file format and require the Flash player is responsible for executing ActionScript a player in order to be displayed to the user. The Flash bytecode. There have been several releases of ActionScript player generally comes in the form of a web browser plugin, since the creation of Flash. Table I outlines the relationship which is used to display Flash files embedded in web pages. between Flash, ActionScript, and ActionScript virtual ma- However, there is also a standalone player that can execute chine versions. An example ActionScript 2.0 function and Flash files without the need for a web browser. the corresponding compiled code using low level Action- Flash files [6] start with a header that contains basic Script actions is shown in Figure 2. meta-information, such as a magic number, the compression status, the Flash version, and the file size. A list of data A. Anatomy of an Attack structures, called tags, immediately follows the header. Each As mentioned previously, Flash is often used to create tag contains a tag type and a size field followed by binary Flash-based advertisements that perform malicious actions. data whose format is dictated by the tag type. These tags A real example of the malicious activity of one such Flash- make up the bulk of a Flash file and contain all the data based malicious advertisement is discussed hereinafter. it may need during execution, such as images, sounds, text, Consider a user with a Flash-capable web browser who and ActionScript code. An example Flash file structure is visits one of her favorite sites. This site uses advertisements displayed in Figure 1. to obtain a steady revenue stream, and it contains an embed- The tags that contain ActionScript code, such as the ded resource with a reference to a malicious advertisement. DoInitAction and DoAction tags, play an integral part in This advertisement is hosted by a third-party network, such var thisdt : Date = new Date(); var d : Date = new Date(); var rundt : Date = new Date(2009,4,30); var utcOffset = -d.getTimezoneOffset() / 60; if(thisdt.getTime() < rundt.getTime()) { if( utcOffset == 2 //halt execution || utcOffset == 3 } || utcOffset == 4 || utcOffset == 5 || utcOffset == 6 Figure 3: The malicious Flash advertisement first checks an || utcOffset == 7) { activation date to determine if its malicious code should be //halt execution } executed. Figure 4: ActionScript 2.0 code to check the user’s time zone to see if the malicious behavior should be disabled. as DoubleClick. The web page loads and makes a request to the advertising network, asking for the advertisement to be displayed. The network determines that the user’s browser var domains : Array = new Array("bug.","corp.","api.", "admin","rightmedia","content.yield","api.yield", has a Flash plugin installed and sends back the relevant "doubleclick"); code to the browser to trigger the display of the Flash var url : String = _root._url; advertisement. if(url.substring(0,7) != "http://") { //halt execution More precisely, the web browser receives some code from }