VPNの脆弱性に関する不安が広がっています。ZPAの60日間無料トライアルを利用して、VPNからの移行のメリットをお確かめください。

Zscalerのブログ

Zscalerの最新ブログ情報を受信

購読する
セキュリティリサーチ

New Fake AV Page Uses Firefox Internals

image
CHRIS MANNON
3月 02, 2011 - 1 分で読了

Most Fake AV pages mimic a Windows Desktop application running. In addition, the Fake AV pages have generally been the same regardless of which browser they are viewed. I recently found a new type of Fake AV page that looks different on each browser. And it also uses internal elements of those browsers.

Internet Explorer version

The version for Internet Explorer looks more like the previous pages I've seen.


Image
Fake AV page for Internet Explorer

The malicious executable InstallInternetDefender_722.exe is detected by only 9.5% of AV!


Image
Virustotal results for malicious executable

Firefox version

The version displayed in Firefox browsers is very interesting. It looks like the security warning Firefox shows for malicious and phishing sites.

Image
Fake AV page for Firefox

The source code of the pages shows that the page is using internal elements of the browser to construct the page:
  • chrome://global/skin/netError.css
  • chrome://global/skin/icons/blacklist_favicon.png
Image
Use of internal Firefox elements

The warning looks very legitimate.

    Chrome version

    Like for Firefox, the Chrome version looks like a legitimate browser warning.

    Image
    First warning from the fake AV page
    Image
    Fake AV page fro Chrome

    Safari version

    For Safari, only the first popup box is tailored to the browser. The main page is the same as Internet Explorer.

    Image
    Fake Av warning for Safari


    Fake AV continues to evolve. This new version for Firefox will surely fool more than one user.


    -- Julien

    form submtited
    お読みいただきありがとうございました

    このブログは役に立ちましたか?

    dots pattern

    Zscalerの最新ブログ情報を受信

    このフォームを送信することで、Zscalerのプライバシー ポリシーに同意したものとみなされます。