Indian Website Burrp Compromised!

Digital extortion has gone mainstream by connecting itself to the masses with noted Indian food and restaurant recommendation website Burrp being compromised with an advanced ransomware exploit kit. Burrp was compromised to redirect users to the Angler exploit kit (EK) in order to deliver the TeslaCrypt ransomware. Cyber criminals took over users’ computers and encrypted their files. They also demanded a ransom for decrypting the files.

Symantec notified Burrp of the compromise and the company has stated that it is working to resolve the issue. Most of the users who have been impacted by this attack are based in the US and India. The site has been sending users to the exploit kit since the beginning of February. TeslaCrypt has the most number of infection visibility across all countries with US leading the pack.

What are exploit kits?

An exploit kit opens a medium for cyber criminals to communicate with the system and feed it codes that include different types of commands. These kits are big money in the underground economy and one of the most notorious among them is the Angler Exploit Kit. Cybercriminals regularly use exploit kits to innovatively find vulnerabilities in systems and infect users with malware.

How the attack works

The Angler Exploit Kit has also been observed delivering exploits for the Microsoft Silverlight Remote Code Execution Vulnerability (CVE-2016-0034). Here are few insights from Symantec on the modus operandi of this virus.

1. Injecting malicious code

First, the attackers compromise a website by injecting code into one of the site’s JavaScript files. When a user clicks on this code they get redirected to a malicious site with “megaadvertize” in the URL.

2. Script received from the exploit kit’s server

The script then sends a POST request to the same remote location. The response to this request includes a file that redirects users to the Angler exploit kit landing page.

3. Angler attempts to exploit the vulnerabilities

If the exploit succeeds, then the TeslaCrypt payload is dropped onto the computer. If the exploit doesn’t work, then the kit drops another file with a different type of exploit to download TeslaCrypt onto the computer.

4. TeslaCrypt in action

Once TeslaCrypt arrives, it writes an executable file to memory, which carries the Trojan’s main functionality. The Trojan then drops the ransom message into every folder with encrypted files. This notice demands that the user pays in bitcoins to obtain the decryption key and restore their data.

Prevention and Protection

The best way for users to avoid infection from these types of attacks is to take preemptive action:

·         Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by attackers.

·         Always keep your security software up to date to protect yourself against any new variants of malware. 

·         Regularly back up any files stored on your computer. If your computer does become infected with ransomware, your files can be restored once the malware has been removed.

If you suspect that a site you use has been compromised, notify the site’s administrator as soon as possible to prevent the attack from spreading further.