1490492 - Affiliate Advertiser Iced Coffee Code Execution

Reporter

Description

•

7 years ago

User Agent: Mozilla/5.0 (Android 8.0.0; Mobile; rv:62.0) Gecko/62.0 Firefox/62.0 Build ID: 20180906142540 Steps to reproduce: Unknown Cause, Unknown Source. Windows 10, latest. Intel x64. The vulnerability likely has something to do with WebRTC. The Malicious Link is http://trk.dsllgal.com/?utm_medium=c3da5eaf624eb0bd8b0053a8e4eca65ade8adf95&utm_campaign=SK_CA Do not open this link, as McAfee flagged it as a Potentially Unwanted Program. This seems to be a drammer type exploit on WebRTC, that allows Remote Code Execution as the process Firefox. Firefox can then modify it's own file structure by using the update process, with a fake update file already provided in the RAM. Once it is updated to the malicious version of firefox.exe, then it has the ability to start doing a drammer like privilege escalation attack on the Operating System Components and other Programs. But of course, this is going to be a multi-stage attack, so naturally firefox is an internet multi-resource, so malware is going to use firefox and not reverse system socket to access it's second or third stage. This also has the ability of bypassing most AV systems, since a newly created malicious URL has to be flagged before it can be caught by the majority of AV systems, where as a reverse system socket is managed by advanced IPS and IDS firewalls, so it is unlikely that the malware would ever make it past the second stage with a reverse system socket. This way, the malware can be confused as legitimate user behaviour of accessing a website, vs downloading malware. The file IO prevention can be explained as Malicious Firefox.exe using a drammer like technique to rewrite the part of the RAM that the file write code is contained in, to corrupt it, and make file write operations impossible. This is useful, since it prevents any AV scanners that did somehow figure out that firefox is now Malicious, from quarantining it. It also allows firefox.exe to continue re-writing RAM in order to privilege escalate, and to steal secrets. This malware doesn't need file write IO, it just needs file read IO, and drammer like abilities to be able to do what it needs for the second or third stage. Actual results: Malware has 0-day exploited firefox core, not extensions. Now firefox redirects all web pages to a specific malicious site, targeted malware (by region). It has turned into a worm, as has rewritten the firefox.exe executable. No other files on the computer were modified. Firefox.exe now runs in the background, and the foreground (when opened). Firefox.exe also seems to have the ability to block all file write operations from happening, even know there is no rootkit or modified system files. So this means the inability to copy, move, rename, or delete files. The inability to modify files is only present in normal operation mode, and does not exist in safe mode. Expected results: There should have been exploit protection, and signature enforcement, as well as memory sandboxing. Plus Firefox should have prevented the user from accessing a site know to be a PUP.

Found in the Firefox Profile Folder, Contains Links to Russian Websites that were never willingly accessed by the user. 7 years ago u623723 93.86 KB, application/json		Details
places.sqlite 7 years ago u623723 10.00 MB, application/octet-stream		Details