avast blocking sites because server cerificates

Although the majority of attacks target routers in Brazil, due to the large amount of vulnerable routers. This and similar campaigns usually appear in waves and target routers around the world. Scanners can be used for free, attackers don’t have to pay for clicks, and can control which IP addresses and ports will be scanned and eventually attacked. On the other hand, using an internet scanner, such as BRUT or masscan, to search for vulnerable routers and attacking them from the outside has its benefits for attackers. The chances of a successful attack on the router using this approach are higher, as many routers are accessible only from the local network.

Once the malicious link is clicked on, the attack is launched from the computer, from within the local network. When a malvertising campaign is used to facilitate the attack, an attacker pays for a campaign that is guaranteed to drive a given number of people to their malicious page. The difference between these two attack approaches is significant. There are videos available online explaining how attacks, like this one, can be executed. The name of the file indicates its purpose – it uses a DNS hijack method to redirect users to phishing webpages where a keylogger (KL) is used to obtain users’ credentials or credit card information. The file we downloaded was named ‘KL DNS.rar’, its structure can be seen below.

We downloaded the linked file and found the complete source code of the GhostDNS exploit kit. The user forgot to disable the Avast Web Shield while doing this, and since the archive was not password protected, it was automatically analyzed by the Shield and it triggered our router exploit kit (EK) detections.

It turned out that one of our Avast users was up to no good, uploading a RAR archive with malicious content to the server.

Router exploit kits are usually distributed via malvertising webpages, and these campaigns appear in waves.Ī year ago (May 2019), our Avast Web Shield, a feature in our antivirus program protecting people from malicious web content, blocked a URL from the file-sharing platform. Router exploit kits are becoming more and more popular among cybercriminals, mostly targeting routers in Brazil, because many Brazilian routers are poorly secured with default and well known login credentials.

Avast blocking sites because server cerificates