Insecure Web

At work, a client recently contacted us about some random ads that were popping up on their site -  interestingly enough through Adobe Acrobat. While I’m on a mac and didn’t experience the popups firsthand, I did pinpoint the problem to come from a hidden iframe located on the page (The client is a news organization and the iframes were being added to the bottom of each news article – so either they suffered an SQL injection or the attacker got into their platform somehow.) It turns out the code was doing something more malicious then just displaying ads.

The source code for the ads were obfuscated to the max – first pulling out and decrypting a mix of character codes and archaic notations out of a pair of hidden DOM elements, then assembling the exploit code and executing it. The whole process is processor intensive and took several seconds to run. The page even contains randomized ids each time you reload the page in what I can only assume was to confuse prying eyes. A copy of that page here:

01_code_on_site.txt

Fortunately, there’s no such thing as irreversible encryption in JavaScript. You can throw in all the evals and random variable names you can but it only takes time to unencrypted it – use Firebug and you can skip the undeciphering process and just console.log right after the exploit code is assembled, right before it executes. That code is here (pretty printed courtesy of jsbeautifier) :

02_rendered_js_code.txt

The most interesting parts of the code are is in functions pdf, pdf2, and pdf3, which tries to detect whether you have the Adobe Acrobat plugin in your browser and tries to load the payload – a tainted PDF file in your browser, followed by a second. Other bits of the code try to run applications through Chrome.

Viewing the JavaScript-laden source code of the blank (on my machine) PDF document is what made me realize it did more than just ads (if it indeed did any ads at all):

03_actual_pdf_exploit.txt

Specifically the code: Collab.collectEmailInfo() which Fortiguard Center indicates is an attempt to exploit a buffer overflow vulnerability in the Adobe PDF reader JavaScript engine. Think rootkits, viruses, etc. .

It’s late and I’m too tired to delve further, but I’m glad I got a copy of all the files (above), as the site in question has removed all traces of them.

I was going to hold off on posting this until I researched it a bit more, but seeing that The Register just posted about it, I figure others may be interested in delving through some real exploit code.

Visit Lurene Grenierat’s blog for an explanation in further detail about the buffer overflow technique used in this exploit.

Update:  Adobe has released a security bulletin warning users of this new vulnerability which is found in both their Acrobat and Acrobat reader products.   This exploit is currently available in the wild.

Mauvis Ledford JavaScript, Web Security Adobe, JavaScript