Hackers Target Silverlight to Deliver Malware

The case for a containment strategy to defend against malware grew even stronger this week with reports that hackers are using vulnerabilities in Microsoft’s Silverlight animation plug-in to deliver malware.

In recent years, numerous exploits found in Adobe Flash and Java have allowed hackers to overcome malware detection systems. To some, Silverlight appeared to be an attractive and safer alternative. NetFlix, who’s video streaming service consumes a humongous percentage of all internet traffic, uses the Silverlight platform in its delivery system.

Cisco researchers are being quoted in SC magazine and numerous other tech media as connecting a recent increase in malvartising and malware infections to exploits in Silverlight , which hackers take advantage of using the popular Angler exploit kit (ET).

In a May crime wave identified by Cisco, a large 3rd party advertising network was compromised and malicious ads (malvertising) were placed on otherwise legitimate web sites. The malvertising then redirected users to a server hosting the Angler ET, which then utilized vulnerabilities in Silverlight to deliver malware to the victim. The attack is similar to what is referred to as a “watering hole” attack, where hackers compromise sites that are popular with their target audience.

A report released on Monday by a US Senate committee warned of the growing privacy and security threats posed by the misuse of online advertising and malvertising. The report cites estimates that “malvertising has increased over 200% in 2013 to over 209,000 incidents generating over 12.4 billion malicious ad impressions.”

The report does a great job defining the threat, but provides no magic bullet for dealing with malicious advertising. In fact, it says that efforts to address it through regulation and legislation have largely stalled.

At the moment, the closest thing to a magic bullet in dealing with scenarios such as this is to use Comodo Internet Security. While other security systems rely on detecting threats, Comodo includes a containment layer that ensures that a malicious program will never be run by the system and harm the computer’s file system.

Comodo’s multi-level protection begins with detecting threats using blacklist of known threats and behavior analysis (heuristics). It also uses a whitelist of known valid files to confirm a program is safe. Other security systems stop there, with detection, but Comodo’s architecture is based on the unique principal of “Default-Deny”. A program is guilty until proven innocent, and will only be allowed to be run by the system if it is confirmed safe.

If a program is not confirmed as safe, it will run in an isolated, secured system called a Sandbox. In the Sandbox, a program can run without harming the computer and its file system while the Comodo system continues monitor it to determine if it is safe.

Detection is great, as far as it goes. But detection without a containment layer leaves a hole that hackers will blast through like excrement through a waterfowl. Only Comodo systematically plugs that home