HTML smuggling techniques bypass traditional network security solutions, such as email scanners, proxies, and sandboxes, by using the features of HTML5 and Javascript. This is done by generating malicious HTML code within the browser on the target device that is already within the security perimeter of the network. Most network security solutions work by monitoring the “wire” or stream of data entering and leaving the network for patterns and signatures of known or suspected malware within the byte stream. Through the use of HTML smuggling, the malicious payload is built within the browser on the target device so that no objects are transferred over the wire for detection by perimeter network security systems.<\/p>\n\n\n\n
Attacks of this type allow a malicious actor to \u201csmuggle\u201d an encoded script within an HTML attachment or specially crafted web page. If the target opens the HTML in their web browser, the malicious script is decoded and the payload is deployed to their device. Therefore, instead of a malicious executable passing directly through a network, the attacker builds the malware locally behind a firewall.<\/p>\n\n\n\n
The goal of HTML smuggling is to deliver a malicious payload to the target device, and this is usually done by downloading via a data URL (data \ud83d\ude42 or by creating a Javascript blob with the appropriate MIME type. to trigger a download to the device. client device. The Duri malware, for example, uses the Javascript blob technique to create and download the malicious payload on the target device.<\/p>\n\n\n\n
When triggered by visiting a malicious website, Duri’s preloader uses Javascript to create a ZIP file and deposit it on the target PC. Then the user must be tricked into opening the ZIP file. If this happens, the contents of the ZIP file are invoked: a Windows Installer package that will install the malware payload on the target device.<\/p>\n\n\n\n
This threat is not unstoppable either, a good network security design uses multiple layers of security provided by different technologies to achieve a \u201cdefense in depth\u201d. Therefore, even if the malware manages to pass the perimeter of the network, it could be detected or blocked by other defensive systems within the network.<\/p>\n","protected":false},"excerpt":{"rendered":"
Cyber\u200b\u200bthreats are many that we can find on the web but… today we will see what HTML smuggling attacks are capable…….<\/p>\n","protected":false},"author":1,"featured_media":3967,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[36],"class_list":["post-3966","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"\n