Java-based Web attack installs hard-to-detect malware in RAM

A hard-to-detect piece of malware that doesn’t create any files on the affected systems was dropped onto the computers of visitors to popular news sites in Russia in a drive-by download attack, according to security researchers from antivirus firm Kaspersky Lab.

Drive-by download attacks are one of the primary methods of distributing malware over the Web. They usually exploit vulnerabilities in outdated software products to infect computers without requiring user interaction.

[ Learn how to greatly reduce the threat of malicious attacks with InfoWorld’s Insider Threat Deep Dive PDF special report. | Stay up to date on the latest security developments with InfoWorld’s Security Central newsletter. ]

Kaspersky Lab researchers recently investigated such an attack on visitors to www.ria.ru, a website that belongs to the Russian RIA Novosti news agency, and www.gazeta.ru, a popular Russian-language online newspaper.

The attack code loaded an exploit for a known Java vulnerability (CVE-2011-3544), but it wasn’t hosted on the affected websites themselves. Instead, it was served to their visitors through banners displayed by a third-party advertising service called AdFox.

What’s interesting about this particular attack is the type of malware that was installed in cases of successful exploitation: one that only lives in the computer’s memory.

“The operation of such an exploit involves saving a malicious file, usually a dropper or downloader, on the hard drive,” said Kaspersky Lab expert Sergey Golovanov, in a blog post on Friday. “However, in this case we were in for a surprise: No new files appeared on the hard drive.”

The Java exploit’s payload consisted of a rogue DLL (dynamic-link library) that was loaded and attached on the fly to the legitimate Java process. This type of malware is rare, because it dies when the system is rebooted and the memory is cleared.

However, this wasn’t a problem for the cybercriminals behind this particular attack, because of the very high probability that most victims would revisit the infected news websites, Golovanov said.

The malicious DLL loaded into memory acted as a bot, sending data to and receiving instructions from a command and control server over HTTP. In some cases, the instructions given out by attackers were to install an online banking Trojan horse on the compromised computers.

“This attack targeted Russian users. However, we cannot rule out that the same exploit and the same fileless bot will be used against people in other parts of the world: They can be distributed via similar banner or teaser networks in other countries,” Golovanov said.

The best protection against this type of attack is to keep the installed software on computers up to date, especially browsers and their plug-ins. In case exploits that target previously unknown vulnerabilities are used, it’s best to have an antivirus product running that is capable of scanning Web traffic and detecting attack code generically.

It’s ideal to stop the infection in its early stages, because once this type of “fileless” malware gets loaded into memory and attaches itself to a trusted process, it’s much harder to detect by antivirus programs, Golovanov said.