Now “ce.ms” Free Domains Are Being Used To Host Malicious Code

October 27, 2011 - 2 Min. de leitura

Conteúdo

Article
Mais blogs

A few months back, I posted a blog on “co.tv” domains being used by attackers to host malicious code . We had identified number of different domains being used to carry out attacks using heavily obfuscated JavaScript. Now it appears that attackers are leveraging free “.ce.ms” domains. Likewise, we have identified a number of .ce.ms domains exploiting various known client side vulnerabilities. Here are a few of the URL’s being used:

hxxp://27glshegbslijels.ce.ms/main.php?page=66c6ce3c7bc4b20c
hxxp://hhhjjjjj111111.ce.ms/main.php?page=423b262d0a1a9f70
hxxp://00000000000000.ce.ms/main.php?page=423b262d0a1a9f70
hxxp://24sjegohmjosee.ce.ms/main.php?page=66c6ce3c7bc4b20c
hxxp://44444444444444444.ce.ms/main.php?page=423b262d0a1a9f70

The aforementioned domains suggest that random domain names are being registered to host these attacks. Once visited, the victim will be presented with obfuscated JavaScript code, formatted in such way to evade IDS, IPS and antivirus solutions. The numbers in the arrays used by the scripts are intentionally spread across separate lines. This way the size of HTML file becomes huge and the total code spans 29K lines. Here is the snapshot of the first part of the malicious code:

Look at the array variable. As can be seen, the numbers used in the array are spread over separate lines. Here is the last part of the script:

Once the above code is decoded, it turns out be related to the Blackhole exploit kit which exploits a variety of known client side vulnerabilities. Here is a small screenshot of the decoded script:

Attackers keep registering different random domains to spread their attacks, often targeting free registration services. Due to obfuscation used by the attackers, security solutions relying on regular expressions designed to match known patterns can often be evaded due to the code being spread of over numerous lines.

Stay safe!!!
Umesh

Obrigado por ler

Esta postagem foi útil?？

Sim, muito útil!

Na verdade, não

Aviso legal: este post no blog foi criado pela Zscaler apenas para fins informativos e é fornecido "no estado em que se encontra", sem quaisquer garantias de exatidão, integridade ou confiabilidade. A Zscaler não se responsabiliza por quaisquer erros, omissões ou por quaisquer ações tomadas com base nas informações fornecidas. Quaisquer sites ou recursos de terceiros vinculados neste post são fornecidos apenas para sua conveniência, e a Zscaler não se responsabiliza por seu conteúdo ou práticas. Todo o conteúdo está sujeito a alterações sem aviso prévio. Ao acessar este blog, você concorda com estes termos e reconhece que é de sua exclusiva responsabilidade verificar e utilizar as informações conforme apropriado para suas necessidades.