GRED WebCheck
Early Warning System against Website Malware Injection(whitepaper revision 20131018A)OVERVIEW
Website is an important part of today’s business and having malicious content
injected in website is bad for business. Hackers are now penetrating into
websites and planting hostile scripts to silently spread malware to its visitors.
This will compromise your customer’s security and privacy. Eventually, searchengines will blacklist your website. Although the website owner is a victim
himself, such events are still very bad for his business's reputation.
In the past year, website malware injection has become one of the top cyberthreats in Japan. According to a Google Transparency Report published in July

2013, 6% of all websites in Japan that are tracked by Google are hosting
malware. Normally, traditional website security will not prevent hackers frominjecting malicious JavaScript such as “drive-by download” scripts into yourHTML web content.
Gred WebCheck is an early warning service to alert the web administrator in theevent of a website injection attack. It is a cloud-based service that continuously
monitors your website for presence of malicious script injections. It has been
awarded “Best New Product” in 2011 by the “Nikkan Kogyo Shimbun”, one of theleading newspapers in Japan.

THREATS LANDSCAPE
Since the late 1990s, email was often used to spread malware. Today, the mostcommon way for malware to spread is while a user visits a compromised websitethat has been instrumented to invoke malware to download and install without
the user's knowledge or consent. This attack is called “drive-by download”.

“Malware now spread mostly through tainted web site…”
USA Today (2013)
Traditionally, website visitors must be tricked into clicking a dialog button to
download and install malware.

Drive-by download has been successful tospread malware because drive-by download attack will silently install malware
on the PCs of visitors who simply visit the website. This type of attack
compromises the security and privacy of your customer, and it is really bad forbusiness.
How does “drive-by download” work? A hacker would penetrate into yourwebsite by exploiting website or web application vulnerabilities.

Commonattacks include SQL injections and exploiting CMS vulnerabilities. Recently,
hackers have been using malware to steal passwords and use them to modify
HTML content to inject drive-by download trigger script. It is very difficult todetect such intrusions because the hackers' actions would appear to be of a web
administrator's actions.

Hackers will add a small script into existing HTML
Hackers will inject a script into existing HTML content that will trigger a Drive-by
download attack on a website visitor. When the trigger script is executed, it willautomatically redirect the visitor's browser to the attacker's website to downloadand install the malware on the visitor's PC.

Hackers also exploit browser

vulnerabilities to perform the attack silently without visitor’s knowledge orconsent.

Drive-by download attack
There are many different types of website injections. Hackers may opt to insert
the entire hostile script into the website content rather than inserting a script toredirect the browser to another site. Hackers can also utilize website to hostcybercrime content. A website can also be hacked by activists and have its
web content replaced with politically motivated message. In all of these cases,
the attack has multiple victims. First, the website visitor will be infected bymalware and PC security and privacy will be compromised.

Second, thewebsite and its company's brand reputation will be impacted, and it is really badfor business.

TRADTIONAL WEB SECURITY
Traditional website owners invest in penetration and vulnerability assessment
testing to ensure that a website is safe from common vulnerability attacks. Dueto cost or practicality issues, such tests are not performed frequently enough tokeep up with new vulnerabilities as they are discovered.

Web application

firewalls are becoming more popular to protect website against common web
attack such as SQL injections, but it does not address everything. For example,a website is still at risk against zero-day vulnerability attack. Also, such security
measures do not enforce strict password management protection policies.
Although traditional web security is important to protect against common website

attack, it cannot stop all attacks. Often website injections are not noticed forweeks and impacts many visitors. Eventually, search engines will blacklist yourwebsite and prevent your visitors from accessing it. To help mitigate this risk, it
is important to have some type of “Early warning” notice to inform web
administrators when his website gets hacked.

By knowing early, it canminimize the damage caused and minimize impact to your business.

Our solution: GRED WebCheck
SecureBrain’s GRED WebCheck is an early warning system for website attacks.
It is a cloud-based service that continuously monitors your website 365x24x7 forthe presence of malware injection and other types of malicious content.
Whenever it finds a malware threat, it will notify the website administrator byautomatically sending an email. The website administrator can then review thedetails on Gred WebCheck’s web portal.

Since it is a cloud-based service(SaaS), there is no hardware or software installation required on the customer'swebsite.
How it works

The administrator registers the URL of the top page of the customer's websitethat needs to be monitored. Upon registration, the system will begin deep
analysis of the website. There are three main parts of the entire process. The
first part is the Download system. It navigates thru the website to download its
content. It will recursively crawl hyperlinks found on the website to automatically
retrieve all the pages of the website that it needs to browse to. The second partis the Inspect system. Its main function is to do a static analysis on the web
content passed by the Download system to look for malicious code. When amalicious threat is found during analysis, the third part, which is the Web Portal,
takes action automatically by sending an email alert to the administrator to notify
him of the problem. Depending on the pre-specified settings, it may also trigger
the redirect feature on the customer's website to automatically redirect users to asafe page upon visiting the infected website. The Web Portal also allows theadministrator to view the details of the attack.
Service Flow

Details of Download System
The Download system navigates thru the website in a similar behavior as to how
a customer would browse thru the website. It also downloads the web content tobe passed on to the next system for inspection. By using this method ofdownloading, it can also retrieve the dynamic web content that is generated byserver side scripting and database retrievals. This automatically discovers newweb content as the website is periodically updated with new data. It recursively
parses thru the HTML pages and finds all of the URL links within the pages. All
external JavaScript found on each page is also downloaded for inspection. Most
importantly, any links to EXE and ZIP files are also downloaded.
Details of Inspection SystemThe Inspection System analyzes all of the downloaded data received from theDownload System. It uses static analysis to do the inspection. There are many
advantages in using static analysis over dynamic analysis, as multiple issues are
known to have been encountered when using dynamic analysis. For example,
several products that use dynamic analysis claim to detect zero-day attacks.
However, this is not a reliable claim to make as most exploits tend to be version
dependent, and its attack code is unlikely to run in emulated environments.
Companion websites where parts of malware are hosted normally gets taken
down, and this would cause dynamic analysis to yield no results as theexecution of the exploit would fail due to the missing site. Dynamic analysis isalso too slow, thus making it impractical to thoroughly scan each web page.
Gred WebCheck's static analysis technology is one of the most effective
methods in analysis. Antivirus products have been detecting malware over thepast 25 years using static analysis methods, which clearly demonstrates that thisis the most reliable way for web malware detection. Gred WebCheck has theability to identify already known "DBD trigger scripts" that launches hostileiframes or JavaScript from companion websites regardless of whether thesecompanion websites are still alive or not. In addition, Gred WebCheck has
variant detection and heuristics detection technology that allows it to potentiallydetect suspicious hostile scripts that may occur in the future. Gred WebCheckuses a large whitelist database for tracking cross domain scripts. This whitelist
database is based on a very lengthy period of data accumulation. Thus, any
unknown cross domain scripts that are likely to be malicious can be easily
identified. Gred WebCheck can also detect URL links of suspicious unsigned
EXE and ZIP files. This is an important feature since some malware variants
tend to upload its own body to propagate itself to other users. Below is a tablethat outlines the different types of threats and scenarios handled during
inspection.
Inspection Target

Details and Examples

Script Injection

Drive-by download trigger JavaScript and iframe
Hostile JavaScript (i.e. exploitation code, shell scripts)
Script execution from untrusted domain (based on user whitelist)

Binary Program

Suspicious EXE scanning (i.e. unsigned binary packed file)
Check inside ZIP file for EXEDefacement

Website Defacement

Crimeware Hosting

Hosting of Phishing, Bogusware, One-click fraud website

Reputation Monitoring

Google search engine blacklist
Japanese police blacklist
JPCERT blacklist

Details of Web Portal
The Web Portal is the mechanism responsible for taking action when a new
threat has been identified in the Inspection System. It collects enough data sothat detailed information can be provided to the administrator via the Web Portal.
An email alert is also sent to the administrator to notify him about the threat.
Please refer to Appendix A to see some of the screenshots of the web portal.

Redirect feature
Whenever a website is hacked, the administrator would not be aware of theproblem until one of its visitors report it to him. By the time the problem is
discovered, a significant period of time would have already elapsed that may
have caused irreversible damages to its business, such as sensitive information
being stolen from the visitor, or the company's reputation suffering. Gred
WebCheck addresses this latency issue by providing a "Redirect feature". How it
works is that it automatically triggers a redirect on an infected web page to a"safe" maintenance page. By doing this, the harmful payload of a hacked
website can be avoided whenever a user tries to visit an infected website. It isvery easy for administrators to use the "Redirect feature". All he needs to do isinclude a very small JavaScript on his website. After this feature is installed, the"Redirect feature" can be easily enabled or disabled using the web portal.
Seal feature
Gred WebCheck provides a seal that can be displayed on a website by insertinga small JavaScript. This seal gives extra assurance to the visitor that the site is
being monitored continuously by a security service to ensure that there is nomalware infection. By clicking on the seal, the visitor can look at the displayed
details to see the site's safety rating and when the site was checked the lasttime.

DISTRIBUTION
GRED WebCheck is offered directly from SecureBrain or from its channel
partners.

Pricing for service varies depending on check frequency andmaximum web pages to check.

For example, a single check per day withmaximum of 300 pages is about US$50 per month.
The service is also available for OEM and volume discount pricing is available.
As of Oct 2013, there are 18 companies that have OEM’ed the service.

OEM List
The web portal for GRED WebCheck has been designed for rebranding. OEMpartners can include their brand logo in the header area and also replace thefooter area with appropriate copyright message and links.

Try GRED WebCheck
If you want to try our technology, visit the following URL to register for limited twoweeks trial service:
http://www.securebrain.co.jp/products/gred/trial.html(English trial registration website will be available in Nov 2013)

About SecureBrain Corporation
Based in Tokyo, Japan, SecureBrain is a leader in providing high quality security
software and services. Our software and services help protect our customers
against Japanese specific cybercrime as well as global internet security threatssuch as online fraud, drive-by downloads and malware attacks. SecureBrain isalso a government contractor specializing in cyber security and has consistently
been awarded numerous contracts every year by the Japanese government.

CONTACT US
SecureBrain Corporation
Web: http://www.securebrain.co.jp/eng
Email: info.intl@securebrain.co.jpAddress: Kioicho Building 7F 3-12 Kioicho, Chiyoda-ku Tokyo, JAPAN
102-0094

APPENDIX A: Screenshots of Web Portal