1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Ask toolbar updates hijacked by attackers to install suspicious code

Discussion in 'News & Current Events' started by allheart55 (Cindy E), Nov 25, 2016.

  1. allheart55 (Cindy E)

    allheart55 (Cindy E) Administrator Administrator

    Joined:
    Jun 11, 2009
    Messages:
    10,621
    Location:
    Pennsylvania
    Operating System:
    Windows 10
    Computer Brand or Motherboard:
    ASUS M4A77TD AM3 AMD 770 ATX AMD
    CPU:
    AMD Phenom II X6 1090T-Thuban 3.2GHz
    Memory:
    Crucial-DDR3 SDRAM 1333-8GB
    Hard Drive:
    WD Caviar Black SE HDD 640 GB - WD Caviar Black SE HDD 500 GB
    Graphics Card:
    Sapphire Radeon HD-7870 2GB
    Power Supply:
    CORSAIR CMPSU-750W
    ask-toolbar-1.jpg


    An unknown attacker hijacked the update mechanism employed by Ask Partner Network (APN) to download suspicious code onto unsuspecting users' PCs.

    APN is best known for the Ask.com search engine browser toolbar. It's a potentially unwanted program (PUP) that is infamously bundled with installers for Java.

    The Ask toolbar and other software designed by APN, a so-called provider of "solutions to help software developers acquire and monetize users," have annoyed users for years.

    8291a1fafcc921da476905547f6c76f0.jpeg

    Given their bundling-based distribution method, the manipulation of search results, and their persistence as downloaded software, it's no wonder Microsoft decided to block the Ask toolbar in 2015.

    Even so, many users have chosen to not remove the Ask Toolbar. That might be because the programs themselves have - for the most part - never directly threatened people's computer security... that is, until recently.

    The research team at Red Canary came across an issue in the beginning of November, as they explain in a blog post:

    "On 5 November, Red Canary detected suspicious activity associated with Windows applications distributed by the Ask Partner Network (a.k.a. APN, Ask.com, or simply Ask). Upon further inspection, we discovered that Ask’s software was being co-opted by a malicious actor to execute malicious software on victims’ endpoints"

    The team spotted some Windows processes associated with Portable Executable (PE, or "binary") files having abnormal extensions. In particular, they detected apnmcp.exe, the update mechanism for Ask Partner Network, associated with a image file named logo.png that was signed a bit too recently for their liking.

    Curious, the researchers dug a little bit deeper and observed some suspicious behaviour:

    03b040833041a86bd5fce945d05653f9.jpeg

    "Note the network connection initiated by logo.png, which was used to pull down 2-3 unique, later-stage binary files that were then executed by logo.png before logo.png itself was deleted from the disk.

    "Of the dozen victims that we observed, all of the first stage (logo.png) binaries were unique, but the later-stage payloads were the same across all victims. Our suspicion is that we caught this during the early stages of deployment or testing, as these processes took very few actions on the victim endpoints. This may have been intentional, or it may have been due to bad payloads or configurations."

    A complete listing of the binaries is available on Red Canary's website.

    So what can we learn from this story?

    We already know that PUPs are a nuisance. But what we don't know is to what degree providers like APN invest in maintaining their solutions. They might not be following security best practices, which means an attacker could compromise their software and try to infect unsuspecting users.

    With that being said, it doesn't matter what the potentially unwanted program is. It still constitutes a potential security threat. Therefore, if an unwanted program downloads itself onto their computer, users should remove it as soon as possible. Period.

    Source: Graham Cluley
     
  2. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    JRT and AdwCleaner always remove any entry for 'Ask'.
    Not hard to see why.
     
    Rustys and allheart55 (Cindy E) like this.

Share This Page