Discovering Evasive Code in Malicious Websites with High- and Low-interaction Honeyclients

No ratings

Presented at FirstConferenceKualaLumpur 2018 by

Yuta Takata

Threats of malicious websites are continuously evolving. These websites are exponentially increasing to achieve attacker's various objectives, e.g., malware distributions, data breaches, defacements, and bitcoin mining. NTT-CERT has been monitoring and detecting such malicious websites by operating both high-interaction honeyclients and low-interaction honeyclients. A high-interaction honeyclient, which is a decoy real browser, can precisely detect browser exploitations and malware downloads. A low-interaction honeyclient, which is a browser emulator, can emulate client profiles, trace complicated redirections, and hook code executions in detail. We usually detect malicious websites and confirm the evidence of maliciousness on the basis of both analysis results. However, attackers also develop more sophisticated techniques to evade our honeyclient analysis. They craft JavaScript code that controls whether to redirect clients to malicious URLs by abusing the differences among client environments. This evasive code is pervasively distributed through exploit kits. Therefore, a countermeasure is urgently needed. My presentation explores evasion techniques by analyzing the redirection differences between high-interaction honeyclients (Internet Explorer) and low-interaction honeyclients (HtmlUnit). Since these honeyclients use different client implementations, I can identify evasive code by leveraging the differences. I investigated 8,500 JavaScript samples executed in 20,000 malicious websites observed in experimental environments of NTT. I discovered previously unknown evasion techniques that abuse the differences among JavaScript implementations. These findings will be necessary for incident responders to understand and analyze modern malicious websites, and contribute to improving the analysis capabilities of conventional honeyclients.Contributions:I introduce the operation of monitoring websites using honeyclients at NTT.I share evasive code examples that abuse the differences among JavaScript implementations.I show the effectiveness of evasive code as content signatures for detecting malicious websites.