ModSecurity Advanced Topic of the Week: Malware Link Detection

Planting of Malware

Planting of malware links into legitimate websites in order to conduct "Drive-by-Downloads" attacks against end-users is a serious concern. Check out the WASC WHID entries for "Planting of Malware" for some real-world examples. Unfortunately for web site owners, there are a myriad of avenues that malicious code and links can be served from their sites. While there are some direct web application methods (e.g. spam links posted to user forums), there are also a number of other attack vectors such as Malvertising (which consists of attackers adding malicious links or code to affiliate data that is included within an organization site context).

A big challenge for web site owners is that, often times, the malware links added to web sites are not overtly malicious. Here are two examples of real malware links that have been detected in web pages:

• Javascript link