Solved Persistent malware in Edge
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
Probably one of the biggest reasons I want to learn why, is I've had to argue with a lot of bosses about why I reimage rather than just fix the application.
How does learning that help with the bosses not understand business basics of cost and risk?
It could help me understand what is getting changed, so that could give me more insight as to the severity of the infection. But, as you've already pointed out, that is pointless to the argument.
The biggest reason I want to learn this, is if I don't understand something, the not knowing drives me crazy.
-
@scottalanmiller said in Persistent malware in Edge:
What is the FULL path of the URL that it is going to?
-
@BBigford said in Persistent malware in Edge:
It could help me understand what is getting changed, so that could give me more insight as to the severity of the infection.
If you know this is just for learning, then yes. If you are doing this in a business, no. You can never be totally certain that you know the depth of an infection, only the depth of one part. A deep infection might masquerade as a shallow one to trick you into thinking you were able to fix it, for example. Or a multi-part infection might have you feel confident in having found one part and not another.
There is no certain fix to a compromised system. This is a fundamental rule of IT security. You can never be sure without rolling back or re-imaging. Any perceived security or fix is smoke and mirrors, you can never be certain enough to put back into production. The advantages of figuring out what happened are myths. What you know is that you no longer know the system and there is only one path back to a know state.
-
@BBigford said in Persistent malware in Edge:
Look in the command line in the quicklaunch shortcut for Edge. Possible that it is hidden in there. Try launching Edge from the command line directly, I bet it works. It's the shortcut that is the issue.
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
Look in the command line in the quicklaunch shortcut for Edge. Possible that it is hidden in there. Try launching Edge from the command line directly, I bet it works. It's the shortcut that is the issue.
Genius!
-
@BBigford it worked?
-
In a situation like this, while I still recommend re-imaging, things like the full URL are important because these attacks are not random (for all intents and purposes) but very targeted. So the URL is the most important part of determining what attack it is.
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford it worked?
Sure did. So there is something infected about the link in the taskbar specifically. That's pretty interesting.
-
@scottalanmiller said in Persistent malware in Edge:
In a situation like this, while I still recommend re-imaging, things like the full URL are important because these attacks are not random (for all intents and purposes) but very targeted. So the URL is the most important part of determining what attack it is.
I agree. Re-imaging would be best. Can you expand on what you mean with specific URLs? Do you mean determining its intent, like if it is redirecting you to a "Microsoft Support" site, vs. just hijacking your search session, etc?
-
@BBigford said in Persistent malware in Edge:
Can you expand on what you mean with specific URLs? Do you mean determining its intent, like if it is redirecting you to a "Microsoft Support" site, vs. just hijacking your search session, etc?
Yes, in your original post you were looking for generic Edge hijacks and intentionally blocking including the URL information of where it was going. But it was always going to the same URL. That there was an issue with Windows, Edge, hijacking or anything else was trivial compared to the importance of the URL. Why did you mention the URL but never just copy and paste it completely?
The reason that you didn't find the fix was that you were looking for very generic information about infections, rather than the one specific piece of info that you had - the URL. The URL was very unique to the infection. Knowing the URL took us straight to the answer.
-
It's hard to say in a generic situation which pieces of information will matter, but including more info rather than less is good. But in this situation, I was able to guess that the URL was the needed piece of the puzzle.
We see this in WordPress infections regularly. Any given infection or attack will have a fingerprint - often it's behaviour. In this case, the behaviour was to go to a specific link (that probably generates revenue, that's the reason for the attack). By knowing who is making the money, you can tell how they likely did it.
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
Can you expand on what you mean with specific URLs? Do you mean determining its intent, like if it is redirecting you to a "Microsoft Support" site, vs. just hijacking your search session, etc?
Yes, in your original post you were looking for generic Edge hijacks and intentionally blocking including the URL information of where it was going. But it was always going to the same URL. That there was an issue with Windows, Edge, hijacking or anything else was trivial compared to the importance of the URL. Why did you mention the URL but never just copy and paste it completely?
The reason that you didn't find the fix was that you were looking for very generic information about infections, rather than the one specific piece of info that you had - the URL. The URL was very unique to the infection. Knowing the URL took us straight to the answer.
What was it about the URL itself that you knew it had to do with the link, rather than within the application itself, regardless of where you run it from?
-
@BBigford said in Persistent malware in Edge:
What was it about the URL itself that you knew it had to do with the link, rather than within the application itself, regardless of where you run it from?
It was a hint in one of your posts (maybe the OP), you included the word "spigot" which is not part of any general search link. So I knew that it was not going directly to Yahoo or any other search site but to something weird and specific that we can be quite reasonably sure, was a specific money making link of some sort.
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
What was it about the URL itself that you knew it had to do with the link, rather than within the application itself, regardless of where you run it from?
It was a hint in one of your posts (maybe the OP), you included the word "spigot" which is not part of any general search link. So I knew that it was not going directly to Yahoo or any other search site but to something weird and specific that we can be quite reasonably sure, was a specific money making link of some sort.
Ah, ok.
-
In this case, it's a bit of business logic applied to the situation rather than technical. If my goal was to attack you and annoy you with sending you to a random site with cat pictures, I could hide that anywhere and could choose any of thousands of cat picture sites to send you to. It would be a funny, but useless attack. And yes, I knew someone that once made malware that only played turkey sounds at random intervals and did nothing else, it happens but... not in the "real" world.
In the real world, any attack is out to make money. If the attack is visible, like by hijacking you, it has to do something to make money. If it is sending you to a website, chances are that site makes it money. To do that, either the attack has to be from the makers of the site itself (Yahoo is not doing that) or it has to be someone that has a deal to make money from the link itself (you can do this with nearly any major website.) So assuming basic business guesses, we can assume the later. So identify the URL, and you identify the attack.
-
Here's an interesting part of running from command line @scottalanmiller ... In previous versions of Edge, it was still run as "spartan.exe" since it was originally Spartan. Then with (I think) 1607, it changed. It's not found in Program Files, it's in SystemApps... drilling down you find MicrosoftEdge, and program type is exe. Doing a run command, you can't run anything like MicrosoftEdge, or adding .exe... You have to run microsoft-edge and add the protocol : // (no space... it created an emoji. :D) at the end, then it will launch. Very weird. Then I noticed you can't run the same command microsoft-edge:// and have the program open from CMD, or even try to launch Edge from any of its directories.... just weird.
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
Look in the command line in the quicklaunch shortcut for Edge. Possible that it is hidden in there. Try launching Edge from the command line directly, I bet it works. It's the shortcut that is the issue.
as I was reading this thread, I was wondering if this was the case.
-
@BBigford said in Persistent malware in Edge:
Here's an interesting part of running from command line @scottalanmiller ... In previous versions of Edge, it was still run as "spartan.exe" since it was originally Spartan. Then with (I think) 1607, it changed. It's not found in Program Files, it's in SystemApps... drilling down you find MicrosoftEdge, and program type is exe. Doing a run command, you can't run anything like MicrosoftEdge, or adding .exe... You have to run microsoft-edge and add the protocol : // (no space... it created an emoji. :D) at the end, then it will launch. Very weird. Then I noticed you can't run the same command microsoft-edge:// and have the program open from CMD, or even try to launch Edge from any of its directories.... just weird.
this is probably because it's a UWP app now instead of a traditional x86 app.
-
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
What was it about the URL itself that you knew it had to do with the link, rather than within the application itself, regardless of where you run it from?
It was a hint in one of your posts (maybe the OP), you included the word "spigot" which is not part of any general search link. So I knew that it was not going directly to Yahoo or any other search site but to something weird and specific that we can be quite reasonably sure, was a specific money making link of some sort.
@scottalanmiller said in Persistent malware in Edge:
@BBigford said in Persistent malware in Edge:
What was it about the URL itself that you knew it had to do with the link, rather than within the application itself, regardless of where you run it from?
It was a hint in one of your posts (maybe the OP), you included the word "spigot" which is not part of any general search link. So I knew that it was not going directly to Yahoo or any other search site but to something weird and specific that we can be quite reasonably sure, was a specific money making link of some sort.
You've completely lost me here. You're saying that you were able to deduce that the URL was injected via the launching shortcut because it went to the same URL everytime? What brings you to that conclusion? This could have just as easily been in homepage field within the browser setttings itself (can't recall if he said he checked that, but it would be one of the first places I would have checked). The shortcut would have been on a short list place for me to look as well.
Another thing I would have checked was to make sure the shortcut for Edge was really going to edge and not going to another file that was acting like a MITM.
But the idea that the URL itself would somehow lead to the conclusion that it was in the shortcut and not buried somewhere deeper in the system, I just don't understand that.
-
@Dashrender said in Persistent malware in Edge:
You've completely lost me here. You're saying that you were able to deduce that the URL was injected via the launching shortcut because it went to the same URL everytime? What brings you to that conclusion?
Because that specific URL is indicative of that specific attack. It's not that it is "a URL", it was that it was "that URL."
