Archive for January, 2013


Can you guess what the following expression returns?

10000000000000000 === 10000000000000001

If you guessed true, you’re right! Consider the next example:

10000000000000000 === 10000000000000000.9

This expression also returns true! In JavaScript, 10000000000000001 is not an integer. This is just one of the many missing JavaScript integers. Why are these integers missing, you might ask?

In IEEE floating point type numbers, the larger the number gets, the bigger the gap between numbers. It makes sense when you look at how the number is stored. — Paul²

Further testing reveals many big integers are not present and can be manipulated under the strictly equal to operator.JavaScript Integers TestBy creating a conditional with “missing integers”, we can mislead the user.

if(10000000000000000 !== 10000000000000001) {
// the average person thinks this is executed
} else {
// this is what’s really being executed
}

Check out some examples on jsFiddle.

Thoughts?
~!Donovan

Further Reading:
http://blog.greweb.fr/2013/01/be-careful-with-js-numbers/¹
http://stackoverflow.com/a/10756881/1585455²

Advertisements

I was looking at some images on Google and was looking at this particular site when I noticed that there was a unusual url request. I did some investigations and found out that the URL request was a malicious hXXp://hzebw.portrelay.com/jentrate.php

Please note that when I tried using automated analysis on the site, using the same referrers and different scanners, the return didn’t include a jentrate.php. You may also want to see the urlQuery results. Maybe there is a time limit between intervals? Or maybe it’s because I’m using a newer version of Firefox?

Basically, like any exploit, cursor starts flashing and a PDF file is automatically downloaded without user verification. You can only guess what happens next: The downloaded file is immediately ran. I didn’t want to fiddle with the outcome of running this PDF and terminated it upon execution, but if you want to check it out, the VirusTotal results and the download link are below.

Download the PDF (Password: infected): http://db.tt/GAcOjZhx
VirusTotal (6/45) as of 2013-01-24 01:32:17 UTC

Moving along, let’s look for more information about the jentrate.php. A search on Google reveals that this jentrate.php can be traced back to January 15th and 16th of 2013, so this is very new. Jsunpack results show us a somewhat familiar buffer overflow script. We also have analysis on Minotaur and a similar threat on urlQuery. Interesting, no?

Finally, I sent the malicious URL I encountered to urlQuery and was greeted with what I expected. A search on CleanMX reveals many entries for this site. Apparently the domain is also associated with a “jokevity.jar”. Have a look at the Wepawet scan.

For those who wish to dig deeper into subject, I strongly encourage you,
~!Donovan

Have you ever seen something like this before?

var1=[Integer];
var2=var1;
if(var1==var2) { document.location=”[Insert URL Here]“; }

I have, and today I finally decided to dig a little deeper. In this article we will cover URLs that are used with this redirecting method, other malicious JavaScript files that have adapted to this method, and test this method with various techniques against the AV industry.

Here is the complete list of the URLs I found that are used as the document.location:

hXtp://ukr.net
hXtp://topsearch10.com/search.php?aid=62756&q=home+jobs
hXtp://popka-super.ru
hXtp://realstarsearch.com/search.php?q=runescape+automine
hXtp://zaebiz.info
hXtp://global-advers.com/soft.php?aid=0153&d=2&product=XPA
hXtp://www.mp3sugar.com/?aff=2081
hXtp://evamendesochka.com/go.php?sid=9
hXtp://catalog--sites.info/sea
hXtp://yahhooo.info/search.php?q=ritalin&tpl=forbot
hXtp://tnij.com/iewt
hXtp://clickcashmoney.com/in.htm?wm=101360
hXtp://www.rarewatches.net
hXtp://web4w3.com/jblob.html
hXtp://мой_сайт.ру
hXtp://www.xakep.ru
hXtp://go.1ps.ru/pr/p.php?223280
hXtp://www.searchfor-avail.com/search.php?aff=18424&q=audrey+bitoni
hXtp://www.vipspace.net/?ref=kuzma2002ru
hXtp://officialmedicines.com/item.php?id=162&aid=2268
hXtp://zonaconsult.ru/index.php?option=com_content&view=article&id=94
hXtp://porta100.narod.ru
hXtp://куда редиректить.ru
hXtp://www.0xy.ru
hXtp://имя домена.ru
hXtp://www.autoshkatulka.ru/index.php
hXtp://www.vsemayki.ru/?ref=11049
hXtp://www.ruclicks.com/in/ys0ik6uu
hXtp://www.links-service.info/search.php?q=Abortion+pill
hXtp://tvoi-dosug.com/in.htm?wm=1001116
hXtp://hotkeysearch.com/go.php?sid=2
hXtp://geforceexlusive.ru:8080/forum/links/column.php

I also found something else rather interesting. There is an “o.js” that uses this method in a more advanced way. Have a look at these two Wepawet results here and here. Notice how they use additional variables whilst using the same concept.

So, let’s make our own redirecting JavaScript! The Wepawet examples are from 2009, so this should have good detection, right?  We will conduct various test to ensure that our results are not flawed. Have a quick look at the list:

  1. The Default Approach
  2. Different Variable Names
  3. Additional Variables
  4. Number Obfuscation
  5. String Obfuscation

Before we move on, for those who would like to do this with me, make sure you have your favorite editor open. I myself use Sublime Text. You can download the samples we will be using from my domain here.

 

The Default Approach – VirusTotal (5/46)

Conditional Redirect Test 1

Well now.. I didn’t expect that myself. Maybe 8-14/46 but 5/46? More so they show the same threat name? I’m speechless considering this was the first test..

 

Different Variable Names – VirusTotal (5/46)

Conditional Redirect Test 2

Ok, so everybody can still detect it. That’s a good thing. How about when we add additional variables?

 

Additional Variables – VirusTotal (0/46)

Conditional Redirect Test 3

And just like that, nobody detects. Seriously, WTF? This kind of simple variable trick passes? In my opinion, more should’ve detected it then the first time, considering it explicitly passes “document” into another variable to be called with with window.

 

Number Obfuscation – VirusTotal (0/46)

Conditional Redirect Test 4

None detect this simple obfuscation method? No, just no… The document.location was left in place and obfuscation was added. I expected more to detect this..

 

String Obfuscation – VirusTotal (0/46)

Conditional Redirect Test 5

Err… how does this miss? ._.

 

We can conclude that the AV industry uses a simple method for checking this kind of exploit. It would look something like this:

When a variable (Var A) is defined,
And another variable (Var B) is set to Var A,
With a conditional between each (Var A and Var B),
And an expression utilizing document.location,
That contains a string (not a variable) with a passed URL,
Then alert and mark as malicious.

Follow the discussion on the avast! forums,

~!Donovan