Fake Firefox Update

I recently have been redirected to fake webpages [strange URLs] prompting me to download an urgent update for Firefox.  This behavior immediately put me on my guard.  I did however download the file, firefox-patch.js, out of curiosity.  It is apparently a java script file.  What is disconcerting about this is that none of my anti-malware tools could identify the file as a threat.  So I then navigated to VirusTotal online, and submitted the file there.  I first noticed that the file had not been scanned before, which is highly unusual.  I think every other time I've scanned a file at VirusTotal, it has told me that the file was previously scanned, and then asked if I would like to re-analyze...  In any case, the results were again surprising:  only 2 out of 54 antivirus products identified the file as malicious.  That kind of detection ratio would typically lead me to suspect a false positive, but I did find a a write-up of this issue on Mozilla [see link], so I'm certain this is indeed a malicious file.

 

The only products able to correctly identify it as a threat were Arcabit and Fortinet, both of which I wasn't familiar with.  I then did a little research on those products, and come to find out:  Arcabit is apparently a Polish language only antivirus, and Fortinet strictly an enterprise product, designed for deployment over a corporate LAN.

 

So bottom line is that I guess if one isn't on one's guard, this will "fly under the radar" of many people.  Does anyone know why the detection rate might be so poor for this file?  It is only 9.13 KB.  Is it easy for malware authors to "hide" malicious code in java script?

 

Link:

 

https://support.mozilla.org/en-US/kb/i-found-fake-firefox-update

Edited by Oxonsi, 14 December 2016 - 02:29 PM.

Can you post the link to the VirusTotal analysis?

Yes, I think I can, see link.  Seems to be quite an insidious threat.

 

https://www.virustotal.com/en/file/6f9deeb5cbf01a90eda8a9e3bc67c8dd9197d3c75193a502bb87c843d08a5bb3/analysis/1481743801/

Detection is low because the JavaScript is heavily obfuscated.

People that make code like that aren't fools, they will test their code vs everything known and if it passes only then will it be used.

Code that can be detected with out problems isn't worth anything and a good Zero day no one knows about can sell on the darknet for like up to $500,000.

Thanks for the replies and info.  In the meantime I was reading online about obfuscated JavaScript.  That's interesting, and it makes sense that malware authors are good at concealing the intent of their code.  It is obviously important to be vigilant online! 

I haven't really used javascript for years but i have to for some places,noscript plugin for firefox owns, most of the drive by download attacks are vs java or flash player in any case and i dont use flash, just look at BC home page, seem a new hack for flash player just bin found one that lets someone take over your cam and mic, man that topic is conic when it comes to flash player its why that topic needs to die and HTML5 needs to take over.

 

Ps: 90% of the time getting infected is tricking people in to installing something they downloaded its not brute force hacking.

How Maliciously Crafted Images Spread Malware. https://www.deepdotweb.com/2016/12/07/maliciously-crafted-images-spread-malware/
Locky Ransomware .svg Attack Vector. http://pastebin.com/BWxLgaVs

How Maliciously Crafted Images Spread Malware. https://www.deepdotweb.com/2016/12/07/maliciously-crafted-images-spread-malware/

 

once more java was the way in, same old same old.

 

 

Locky Ransomware .svg Attack Vector. http://pastebin.com/BWxLgaVs

 

Not pro at reading code but if i didn't miss my guess just one more case of java.

Hi, @shadow_647:

 

 

How Maliciously Crafted Images Spread Malware. https://www.deepdotweb.com/2016/12/07/maliciously-crafted-images-spread-malware/

 

once more java was the way in, same old same old.

 

 

Locky Ransomware .svg Attack Vector. http://pastebin.com/BWxLgaVs

 

Not pro at reading code but if i didn't miss my guess just one more case of java.

 

 

I think it may be confusing for the OP (and for non-experts like myself) to use "Java" and "JavaScript" interchangeably?

Needless to say, they are not the same thing.

 

If I understand the thread correctly, the OP is talking about scripted malware/obfuscated JavaScript, not "Java".

 

Cheers,

MM

Right, sorry about that ill be shoure from now on to all ways say javascript.

It's not only fake Foxfire updates you have to be careful with but also other popular software like Adobe and Java which are also exploited.

BTW...Ransomware developers have been known to use malicious .js (JavaScript) files often found in zipped email attachments.

• Browsing malicious websites
• JavaScript Malware a Growing Trend Explained for Everyday Users
• Ransomware in your inbox: the rise of malicious JavaScript attachments

Many users confuse JavaScript with Java, a software package by Oracle installed separately from your browser. Although the name is similar, Java is not the same as JavaScript. For the benefit of all readers, here are a few articles to help you understand.
 

Because of the unfortunate similarity of their names, many people confuse Java with Javascript. But these are two completely different things. Most Web sites use JavaScript, a powerful scripting language that helps make sites interactive. Unfortunately, a huge percentage of Web-based attacks use JavaScript tricks to foist malicious software and exploits onto site visitors. To protect yourself, it is critically important to have an easy method of selecting which sites should be allowed to run JavaScript in the browser. It is true that selectively allowing JavaScript on known, safe sites wont block all malicious scripting attacks: Even legitimate sites sometimes end up running malicious code when scammers figure out ways to sneak tainted, bogus ads into the major online ad networks. But disallowing JavaScript by default and selectively enabling it for specific sites remains a much safer option than letting all sites run JavaScript unrestricted all the time.

Krebs On Security: What You Need to Know About the Java Exploit

• Java and JavaScript there is a huge difference
• How is JavaScript different from Java?
• JavaScript is not Java