Os threat actors por trás da campanha estão aproveitando as falhas conhecidas em plugins do WordPress, como “Coming Soon and Maintenance Mode”, “Yellow Pencil Visual CSS Style Editor” e “Blog Designer.”
Os investigadores da Defian apontaram que esses plugins estão instalados em milhares de sites no mundo inteiro.
Os invasores injetam um pequeno código JavaScript projetado para descarregar código adicional de um domínio externo e executá-lo sempre que os visitantes acedam ao website comprometido.
“The Defiant Threat Intelligence team has identified a malvertising campaign which is causing victims’ sites to display unwanted popup ads and redirect visitors to malicious destinations, including tech support scams, malicious Android APKs, and sketchy pharmaceutical ads.” states the report published by WordFence. “By targeting a few recently disclosed WordPress plugin vulnerabilities, the attackers inject a JavaScript payload into the front end of a victim’s site. These injections each contain a short script which sources additional code from one or more third-party URLs. That code is executed when a visitor opens the victim website.”
As vítimas são inicialmente redirecionadas para um domínio usado para verificar o tipo de dispositivo usado pelos visitantes e, em seguida, o código malicioso redireciona-os para destinos mal-intencionados, incluindo scams de suporte técnico, websites que exibem APKs Android maliciosos e anúncios falsos sobre produtos farmaceuticos.
The hackers have exploited stored cross-site scripting (XSS) vulnerabilities in Blog Designerand Coming Soon and Maintenance Mode, and an unauthenticated arbitrary options update issue in the Yellow Pencil plugin.
“The Yellow Pencil vulnerability is notable because, in most configurations, an attacker could enable new user registrations with Administrator privileges, leading to takeover of vulnerable sites. Instead of taking the sites over entirely, these attackers seem satisfied with the malvertising campaign by itself. ” continues the report.
Os especialistas revelaram que a vulnerabilidade de escalonamento de privilégios no plugin Yellow Pencil foi explorada numa campanha em abril. A falha pode ser explorada por invasores para carregar opções arbitrárias em instalações vulneráveis.
Especialistas do Wordfence observaram um grande volume de tentativas de explorar a vulnerabilidade depois que de um investigador de segurança divulgar publicamente um código de exploração de prova de conceito (POC) para um conjunto de duas vulnerabilidades que afetam o plugin.
A vulnerabilidade de escalonamento de privilégios reside no ficheiro yellow-pencil.php. O ficheiro é então usado para verificar se o parâmetro yp_remote_get foi configurado e, em caso afirmativo, o plug-in escalará os privilégios de utilizador para administrador.
“The majority of the XSS injection attempts tracked across this campaign were sent by IP addresses linked to popular hosting providers,” concludes the report. “With attacks sourced from IPs hosting several live websites, as well as our own evidence of infected sites associated with this campaign, it’s likely the threat actor is using infected sites to deliver XSS attacks by proxy.”
Pedro Tavares is a professional in the field of information security working as an Ethical Hacker/Pentester, Malware Researcher and also a Security Evangelist. He is also a founding member at CSIRT.UBI and Editor-in-Chief of the security computer blog seguranca-informatica.pt.
In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, exploitation, hacking, IoT and security in Active Directory networks. He is also Freelance Writer (Infosec. Resources Institute and Cyber Defense Magazine) and developer of the 0xSI_f33d – a feed that compiles phishing and malware campaigns targeting Portuguese citizens.
Read more here.