Hiding in Plain Sight: An Empirical Study of Web Application Abuse in Malware
Hiding in Plain Sight: An Empirical Study of Web Application Abuse in Malware
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Mingxuan Yao;J. Fuller;R. Sridhar;Saumya Agarwal;A. Sikder;Brendan Saltaformaggio
中科院分区：
文献类型：
--
作者：
Mingxuan Yao;J. Fuller;R. Sridhar;Saumya Agarwal;A. Sikder;Brendan Saltaformaggio
Web应用程序提供了广泛的实用程序，这些实用程序被恶意软件滥用，作为传统攻击者控制的服务器的替代品。要阻止这些Web App恶意软件，需要事件响应者和Web应用程序提供商之间的快速协作。不幸的是，我们的研究发现，这种合作的延迟使WAE恶意软件得以蓬勃发展。我们开发了Marsea，这是一个自动化的恶意软件分析管道，可以研究WAE恶意软件并实现快速修复。Marsea发现了97个家庭中的893个WAE恶意软件，它们滥用了29个Web应用程序。我们的研究发现，自2020年以来，WAE恶意软件的数量增加了226%，恶意软件作者开始减少对攻击者控制的服务器的依赖。事实上，我们发现依赖攻击者控制的服务器的WAE恶意软件减少了13.7%。到目前为止，我们已经使用Marsea与Web应用程序提供商合作，删除了50%的恶意Web应用程序内容。
Web applications provide a wide array of utilities that are abused by malware as a replacement for traditional attacker-controlled servers. Thwarting these Web App-Engaged (WAE) malware requires rapid collaboration between incident responders and web app providers. Unfortunately, our research found that delays in this collaboration allow WAE malware to thrive. We developed Marsea, an automated malware analysis pipeline that studies WAE malware and enables rapid remediation. Given 10K malware samples, Marsea revealed 893 WAE malware in 97 families abusing 29 web apps. Our research uncovered a 226% increase in the number of WAE malware since 2020 and that malware authors are beginning to reduce their reliance on attacker-controlled servers. In fact, we found a 13.7% decrease in WAE malware relying on attacker-controlled servers. To date, we have used Marsea to collaborate with the web app providers to take down 50% of the malicious web app content.