- Jul 22, 2014
- 2,525
The Ask Partner Network (APN) was compromised for the second time in two months, as crooks found a way to deliver malware to computers running the Ask.com Toolbar.
The first attack took place at the end of October and start of November 2016, and was detected by security researchers from Red Canary. The second took place in December, just after APN cleaned its network, and was picked up by Carbon Black security products.
Both incidents were similar, as attackers found a way to breach the APN network and hijack the Ask.com Toolbar update process, pointing users to a malicious file, which resulted in the installation of malware on affected computers.
Crooks hijacked Ask.com Toolbar update process
For the first attack, crooks altered the Ask.com Toolbar update process to download and install a malicious update package which then used a PNG file to spawn a malicious process.
This somewhat non-standard behavior was picked up by Red Canary, who detected the attack and sounded the alarm but not before crooks compromised around ten victims.
APN intervened, cleaned their network and revoked the digital certificate (issued in their name), which crooks used to sign the malicious update package. APN then issued a new digital certificate to sign future updates.
The second attack installed RAT on victim's PC
...
The first attack took place at the end of October and start of November 2016, and was detected by security researchers from Red Canary. The second took place in December, just after APN cleaned its network, and was picked up by Carbon Black security products.
Both incidents were similar, as attackers found a way to breach the APN network and hijack the Ask.com Toolbar update process, pointing users to a malicious file, which resulted in the installation of malware on affected computers.
Crooks hijacked Ask.com Toolbar update process
For the first attack, crooks altered the Ask.com Toolbar update process to download and install a malicious update package which then used a PNG file to spawn a malicious process.
This somewhat non-standard behavior was picked up by Red Canary, who detected the attack and sounded the alarm but not before crooks compromised around ten victims.
APN intervened, cleaned their network and revoked the digital certificate (issued in their name), which crooks used to sign the malicious update package. APN then issued a new digital certificate to sign future updates.
The second attack installed RAT on victim's PC
...
