Equifax website borked again, this time to redirect to fake Flash update

In May credit reporting service Equifax's website was breached by attackers who eventually made off with Social Security numbers, names, and a dizzying amount of other details for some 145.5 million US consumers. For several hours on Wednesday, and again early Thursday morning, the site was maliciously manipulated again, this time to deliver fraudulent Adobe Flash updates, which when clicked, infected visitors' computers with adware that was detected by only three of 65 antivirus providers.

Randy Abrams, an independent security analyst by day, happened to visit the site Wednesday evening to check what he said was false information he had just found on his credit report. Eventually, his browser opened up a page on the domain hxxp//:centerbluray.info that looked like this:


Randy Abrams



He was understandably incredulous. The site that previously gave up personal data for virtually every US person with a credit history was once again under the influence of attackers, this time trying to trick Equifax visitors into installing crapware Symantec calls Adware.Eorezo. Knowing a thing or two about drive-by campaigns, Abrams figured the chances were slim he'd see the download on follow-on visits. To fly under the radar, attackers frequently serve the downloads to only a select number of visitors, and then only once.

Abrams tried anyway, and to his amazement, he encountered the bogus Flash download links on at least three subsequent visits. The picture above this post is the higher-resolution screenshot he captured during one visit. He also provided the video below. It shows an Equifax page redirecting the browser to at least four domains before finally opening the Flash download at the same centerbluray.info page.



Equifax Flash Download

The file that got delivered when Abrams clicked through is called MediaDownloaderIron.exe. This VirusTotal entry shows only Panda, Symantec, and Webroot detecting the file as adware. This separate malware analysis from Payload Security shows the code is highly obfuscated and takes pains to conceal itself from reverse engineering. Malwarebytes flagged the centerbluray.info site as one that pushes malware, while both Eset and Avira provided similar malware warnings for one of the intermediate domains, newcyclevaults.com.

https://arstechnica.com/information-technology/2017/10/equifax-webs...

Views: 132

Comment

You need to be a member of 12160 Social Network to add comments!

Join 12160 Social Network

 

 

Latest Activity

Inretrospect commented on Diana's photo
Thumbnail

Antifa mooning Portland cops 11-17

"Wouldn't this be lawfully considered "indecent exposure"?   It's never a nice looking chick with a cute ass. I'll know where that cop would like to stick his baton."
5 minutes ago
Boris Badenov replied to Diana's discussion Alexandria Ocasio-Cortez Can’t Get Three Branches Of Government Right – “The Presidency, The Senate and The House”
"Super low IQ"
6 minutes ago
Boris Badenov favorited Diana's photo
18 minutes ago
Diana posted discussions
18 minutes ago
Diana posted photos
37 minutes ago
dogitydog commented on Boris Badenov's page Tucker Carlson EMBARASSES College Student Over Illegal Immigration
"@Sink Chicken Because the colleges and universities were quietly weaponized while we weren't looking. They caught us with our pants down and our heads up our ass."
39 minutes ago
Diana favorited cheeki kea's photo
40 minutes ago
flart blooger commented on Boris Badenov's page Wonder if anybody loves anything as much as Acosta loves Acosta
"they should do a celebrity cage match for him and chuck schumer to fight to the death for a microphone..... for charity. "
46 minutes ago
Diana posted videos
55 minutes ago
Sink Chicken commented on Boris Badenov's page Tucker Carlson EMBARASSES College Student Over Illegal Immigration
"Why is it that every college student interviewed regurgitate the democrat tripe?"
1 hour ago
Diana commented on Diana's photo
Thumbnail

Current Situation In Haiti

"A U.N.-Backed Police Force Carried Out A Massacre In Haiti. The Killings Have Been Almost Entirely Ignored. haitiantimes.com/2018/11/14/a-u-n-backed-police-force-carried-out-a-massacre-in-haiti-the-killings-have-been-almost-entirely-ignored/"
1 hour ago
dogitydog posted a blog post

OPERATION HOT MUSKET?

Has anyone heard of this. An active duty enlistee has called in to Marfoogle News to inform us that he was given a 72 hour notice to deploy domestically. His training is in…See More
2 hours ago
Thomas Less posted blog posts
3 hours ago
Inretrospect commented on jim's blog post 5G Danger Radiation Is Coming
"@ Jim.  One of the hardest things to do, is trying to save someone from their self.  It becomes even more arduous when that someone is a family member, friendly neighbor, or co-worker.  BTW: I see zombies every day, sitting in a…"
4 hours ago
dogitydog commented on Diana's photo
Thumbnail

Antifa brought guillotines in Goodwill carts, Portland 11-17

"We will spend billions of dollars deploying our military around the world hunting down terrorists (supposedly), but do nothing when a terrorist organization repeatedly terrorizes U. S. citizens on our own turf and then you tell us that there is no…"
4 hours ago
dogitydog commented on Raz Putin's video
Thumbnail

Exclusive Interview with Fire Captain on Origins of CA Fires

"Thank you Raz Putin I almost posted that video this morning but got sidetracked. I'm glad you did because even though it is not concrete evidence of DEW"S, it is one more testimony from a very credible person with the credentials…"
5 hours ago
cheeki kea posted blog posts
5 hours ago
cheeki kea commented on cheeki kea's photo
Thumbnail

POP goes the Weasel

"Up n' down the city road, In n' out of the eagle, That's the way the money goes, Pop goes the weasel. "
6 hours ago
cheeki kea commented on cheeki kea's photo
Thumbnail

What's not clear ?

"Don't know what this lier smokes, but I guess it would be anti-truth serum Vape."
6 hours ago
cheeki kea commented on Deep Space's photo
Thumbnail

Assange: "Bad" / Hillary: "Good"

"Julian has recently employed a PR company to assist in his cause and bolster his world image. "
7 hours ago

Please remember this website is supported by your donations...

© 2018   Created by truth.   Powered by

Badges  |  Report an Issue  |  Terms of Service

content and site copyright 12160.info 2007-2015 - all rights reserved. unless otherwise noted