Malvertisers exploited a zero-day vulnerability in the browser engine used by Safari and other iOS apps, according to Eliya Stein at Confiant. The vulnerability, which was patched earlier this month, allowed the attackers to bypass WebKit’s iframe sandboxing policy in order to redirect users to scam sites.
“The `allow-top-navigation-by-user-activation` sandbox attribute, which is often lauded as one of the most vital tools in an anti-malvertising strategy should in theory prevent any redirection unless a proper activation takes place,” Stein explains. “Activation in this context typically means a tap or a click inside the frame. This means our proof of concept shouldn’t work under any circumstances. The clickMe button is outside of the sandboxed frame after all. However, if it does redirect, that means we have a browser security bug on our hands, which turned out to be the case when tested on WebKit based browsers, namely Safari on desktop and iOS.”
The attackers behind this campaign are known as “ScamClub,” and they’re known for using forced redirections to web pages that offer phony prizes.
“On the tactics side, this attacker historically favors what we refer to as a ‘bombardment’ strategy,” Stein writes. “Instead of trying to fly under the radar, they flood the ad tech ecosystem with tons of horrendous demand well aware that the majority of it will be blocked by some kind of gatekeeping, but they do this at incredibly high volumes in the hopes that the small percentage that slips through will do significant damage.”
Stein adds that the zero-day probably made a huge impact on the number of victims who were redirected to the scam sites.
“Combined with ScamClub’s large volumes and broad targeting that hits dozens of different websites, it’s all about the increased efficacy of spawning a successful redirect — even if we’re talking about a single digit percentage increase, that can mean tens of thousands of impacted impressions over the duration of a single campaign,” Stein says.
A zero-day is going to escape many technical defenses, which is all the more reason to inculcate awareness and appropriate caution in your people. New-school security awareness training can enable your employees to avoid falling for things that seem too good to be true.
Confiant has the story.
