The Angler exploit kit favors Silverlight and Flash exploits over Java, researchers from Cisco said
Microsoft Silverlight vulnerabilities are increasingly being exploited in drive-by download attacks to infect computers with malware, especially through malicious ads.
Attackers have been adding exploits for Silverlight vulnerabilities to their exploit kits, tools that are commonly used to launch Web-based attacks, according to security researchers from Cisco Systems.
“Silverlight exploits are the drive-by flavor of the month,” the Cisco security researchers said Monday in a blog post. “Since April 23rd we have observed substantial traffic (often from malvertising) being driven to Angler instances partially using Silverlight exploits.”
Angler is the second exploit kit to incorporate Silverlight exploits after a similar tool called Fiesta added exploits for two Silverlight vulnerabilities in January.
Typically when a user is redirected to an attack page, the exploit kit performs a test to determine the users’ browser and installed plug-ins — Flash Player, Java, Adobe Reader, Silverlight, etcetera. If any of them are outdated and vulnerable, the exploit kit serves the corresponding exploit from its available arsenal.
For the past several years, Java has consistently been the most frequently targeted browser plug-in because Java exploits proved to be particularly effective against the large user base with outdated installations, particularly in enterprise environments. However, that’s beginning to change.
“In this particular Angler campaign, the attack is more specifically targeted at Flash and Silverlight vulnerabilities and though Java is available and an included reference in the original attack landing pages, it’s never triggered,” the Cisco researchers said.
The Angler attacks detected recently by Cisco were launched through malicious ads, an action known as malvertising. Specifically, users visited legitimate websites that unknowingly served rogue ads from a compromised ad network. The ads then redirected users’ browsers to a hacked website that further redirected them to an Angler landing page.
The Angler attack page loaded a Silverlight exploit that chained two vulnerabilities together — CVE-2013-3896, patched by Microsoft in October 2013, and CVE-2013-0074, patched in March 2013. If the exploits were successful, a computer Trojan that connects back to a remote server in Brazil was installed, the Cisco researchers said.
“We should expect these existing Silverlight exploits to proliferate through other exploit pack families in the near future as threat actors copy code from each other and release updates,” the researchers said. “Silverlight exploits are also ideal because Silverlight continues to gain rich Internet application market share, perhaps surpassing Java, and Microsoft’s life cycle schedule suggests Silverlight 5 will be supported through October, 2021.”
The Silverlight exploit used in the Angler attack campaign managed to infect about 10 percent of users who reached the landing page, a reasonable success rate for exploit kits, according to the Cisco researchers.
Users who have Silverlight on their computers should make sure that they install the latest available update for the program.
