Website Forensic Investigation to Identify Evidence and Impact of Compromise

Abstract

Compromised websites that redirect users to malicious websites are often used by attackers to distribute malware. These attackers compromise popular websites and integrate them into a drive-by download attack scheme to lure unsuspecting users to malicious websites. An incident response organization such as a CSIRT contributes to preventing the spread of malware infection by analyzing compromised websites reported by users and sending abuse reports with detected URLs to webmasters. However, these abuse reports with only URLs are not sufficient to clean up the websites; therefore, webmasters cannot respond appropriately to such reports. In addition, it is difficult to analyze malicious websites across different client environments, i.e., a CSIRT and a webmaster, because these websites change behavior depending on the client environment. To expedite compromised website clean-up, it is important to provide fine-grained information such as the precise position of compromised web content, malicious URL relations, and the target range of client environments. In this paper, we propose a method of constructing a redirection graph with context, such as which web content redirects to which malicious websites. Our system with the proposed method analyzes a website in a multi-client environment to identify which client environment is exposed to threats. We evaluated our system using crawling datasets of approximately 2,000 compromised websites. As a result, our system successfully identified compromised web content and malicious URL relations, and the amount of web content and the number of URLs to be analyzed were sufficient for incident responders by 0.8% and 15.0%, respectively. Furthermore, it can also identify the target range of client environments in 30.4% of websites and a vulnerability that has been used in malicious websites by leveraging target information. This fine-grained information identified with our system would dramatically make the daily work of incident responders more efficient.

A Appendix: Difference Between Proposed Graph and Conventional Graph

We show redirection graph examples constructed with the referer-based method [14], the heuristic-based method [15], and the proposed method in Figs. 10, 11, and 12, respectively. Figure 10 depicts a graph smaller than the other graphs because a redirection without a Referer header was caused by a function of the location object. In this case, the referer-based method cannot connect the any of the following redirections. The heuristic-based method can connect all redirections. However, semantic gaps between Referer headers and JavaScript redirections occur. As a result, we cannot identify precise redirection origins, e.g., the web content of URL “http://DOMAIN10/gzcr?t=[a-zA-Z0-9]{118},” due to the gaps. Our method can connect all redirections and precisely identify all of their redirection origins.

Fig. 10.

Redirection graph constructed by referer-based method.

Fig. 11.

Redirection graph constructed by heuristic-based method (WebWitness).

Fig. 12.

Redirection graph constructed by proposed method (redirection call graph).