Understanding the Web browser threat: Examination of vulnerable online Web browser populations and the

Abstract

In recent years the Web browser has increasingly becometargeted as an infection vector for vulnerable hosts. Classicservice-centric vulnerability exploitation required attackers toscan for and remotely connect to vulnerable hosts (typicallyservers) in order to exploit them. Unlike these, Web browservulnerabilities are commonly exploited when the user of thevulnerable host visits a malicious Web site.Attacks against Web browsers depend upon malicious con-tent being rendered by the appropriate built-in interpreter (e.g.,HTML, JavaScript, CSS, etc.) or vulnerable plug-in technol-ogy (e.g., Flash, QuickTime, Java, etc.) [1, 2]. Vulnerabilitieslying within these rendering technologies are then exposed toany exploit techniques or malicious code developed by the at-tacker. Vulnerability trend reports have indicated that remotelyexploitable vulnerabilities have been increasing since the year2000 and reached 89.4% of vulnerabilities reported in 2007[3]. A growing percentage of these remotely exploitable vul-nerabilities are associated with Web browsers.Profit motivated cyber-criminals have rapidly adopted Webbrowser exploitation as a key vector for malware installation.Due to the methodology of exploiting Web browser vulner-abilities and the unpredictable browsing patterns of typicalusers, for widespread infection of vulnerable hosts the crim-inals must seed a mix of popular and high-traffic websites, orincentivize users through email spam, with URLs directing po-tential victims to Web servers hosting their malicious content.The former method is commonly known as drive-by down-load, where ”drive-by” refers to the fact that Web browsersmust initially navigate to a malicious page and ”download”refers to the covertly downloaded and executed malware - typ-ically trojans.As popularity of this attack vector has blossomed, there havebeen frequent reports of hundreds of thousands of Web sitessuccumbing to mass-defacement [1, 4, 5, 6, 7, 8] - where the”defacement” often consists of an embedded iframe. Theseiframes typically inlcude content from servers hosting mali-cious JavaScript code designed to exploit vulnerabilities ac-cessible through the user’s Web browser and subsequently toinitiate a drive-by malware download. These mass-defacements