Silverlight malvertising exploits on the rise

The Angler exploit kit favors Silverlight and Flash exploits over Java, researchers from Cisco said

Microsoft Silverlight vulnerabilities are increasingly being exploited in drive-by download attacks to infect computers with malware, especially through malicious ads.

Attackers have been adding exploits for Silverlight vulnerabilities to their exploit kits, tools that are commonly used to launch Web-based attacks, according to security researchers from Cisco Systems.

"Silverlight exploits are the drive-by flavor of the month," the Cisco security researchers said Monday in a blog post. "Since April 23rd we have observed substantial traffic (often from malvertising) being driven to Angler instances partially using Silverlight exploits."

Angler is the second exploit kit to incorporate Silverlight exploits after a similar tool called Fiesta added exploits for two Silverlight vulnerabilities in January.

Typically when a user is redirected to an attack page, the exploit kit performs a test to determine the users' browser and installed plug-ins -- Flash Player, Java, Adobe Reader, Silverlight, etcetera. If any of them are outdated and vulnerable, the exploit kit serves the corresponding exploit from its available arsenal.

For the past several years, Java has consistently been the most frequently targeted browser plug-in because Java exploits proved to be particularly effective against the large user base with outdated installations, particularly in enterprise environments. However, that's beginning to change.

"In this particular Angler campaign, the attack is more specifically targeted at Flash and Silverlight vulnerabilities and though Java is available and an included reference in the original attack landing pages, it's never triggered," the Cisco researchers said.

The Angler attacks detected recently by Cisco were launched through malicious ads, an action known as malvertising. Specifically, users visited legitimate websites that unknowingly served rogue ads from a compromised ad network. The ads then redirected users' browsers to a hacked website that further redirected them to an Angler landing page.

The Angler attack page loaded a Silverlight exploit that chained two vulnerabilities together -- CVE-2013-3896, patched by Microsoft in October 2013, and CVE-2013-0074, patched in March 2013. If the exploits were successful, a computer Trojan that connects back to a remote server in Brazil was installed, the Cisco researchers said.

"We should expect these existing Silverlight exploits to proliferate through other exploit pack families in the near future as threat actors copy code from each other and release updates," the researchers said. "Silverlight exploits are also ideal because Silverlight continues to gain rich Internet application market share, perhaps surpassing Java, and Microsoft's life cycle schedule suggests Silverlight 5 will be supported through October, 2021."

The Silverlight exploit used in the Angler attack campaign managed to infect about 10 percent of users who reached the landing page, a reasonable success rate for exploit kits, according to the Cisco researchers.

Users who have Silverlight on their computers should make sure that they install the latest available update for the program.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Microsoftpatch managementmalwareonline safetyCisco SystemspatchesExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?