Hunting the Red Fox Online: Understanding and Detection of Mass Redirect-Script Injections

Abstract

Compromised websites that redirect web traffic to malicious hosts play a critical role in organized web crimes, serving as doorways to all kinds of malicious web activities (e.g., drive-by downloads, phishing etc.). They are also among the most elusive components of a malicious web infrastructure and extremely difficult to hunt down, due to the simplicity of redirect operations, which also happen on legitimate sites, and extensive use of cloaking techniques. Making the detection even more challenging is the recent trend of injecting redirect scripts into JavaScript (JS) files, as those files are not indexed by search engines and their infections are therefore more difficult to catch. In our research, we look at the problem from a unique angle: the adversary's strategy and constraints for deploying redirect scripts quickly and stealthily. Specifically, we found that such scripts are often blindly injected into both JS and HTML files for a rapid deployment, changes to the infected JS files are often made minimum to evade detection and also many JS files are actually JS libraries (JS-libs) whose uninfected versions are publicly available. Based upon those observations, we developed JsRED, a new technique for the automatic detection of unknown redirect-script injections. Our approach analyzes the difference between a suspicious JS-lib file and its clean counterpart to identify malicious redirect scripts and further searches for similar scripts in other JS and HTML files. This simple, lightweight approach is found to work effectively against redirect injection campaigns: our evaluation shows that JsRED captured most of compromised websites with almost no false positives, significantly outperforming a commercial detection service in terms of finding unknown JS infections. Based upon the compromised websites reported by JsRED, we further conducted a measurement study that reveals interesting features of redirect payloads and a new Peer-to-Peer network the adversary constructed to evade detection.

Fine-Grained Analysis of Compromised Websites with Redirection Graphs and JavaScript Traces

“…Methods of detecting website compromises that compare original web content to compromised web content have been proposed [12], [13]. Furthermore, TripWire [14], widely known as a compromise detection tool, can detect file operations, such as modification and deletion, by monitoring files on a web server.…”

“…For example, a comparison method [12] using HTML files as original content and a comparison method [13] using well known libraries and frameworks of JavaScript as original content have been proposed. Moreover, TripWire [14] can notify webmasters of changes on websites by e-mail when file operations are detected on a web server on which TripWire is installed.…”

Principled Sampling for Anomaly Detection

“…Some common applications include detecting malicious websites [44], [48], automatically neutralizing malicious JavaScript code [18], [20], [28], [36], and filtering anomalies in more general data types that, in today's world, are usually acquire from the web [37], [38].…”

“…With respect to collecting representative samples from the web, while we are not aware of any work that samples directly from the PageRank distribution, several works on anomaly detection have employed crawl based methods for collecting data [20], [37], [36], [48]. It has been recognized that simply drawing webpages from a known list (i.e.…”

“…Fortuna focuses specifically on anomaly detection systems that handle data from browsing the Internet. This class of systems is very well studied and includes, for example, anomaly detectors that filter potentially anomalous video, images, and JavaScript files [18], [20], [28], [36], [38] or seek to filter entire malicious webpages [44], [47], [48]. Nevertheless, our approach is broad and we provide a general framework for building analysis systems for other classes of anomaly detectors.…”