What Protection is There Against Malicious Codes in Compromised Websites

Malicious codes are some of the most dangerous methods cybercriminals use.

When talking about attacks and threats that users are exposed to every day, one encounters predictable compromises again and again. This includes, for example, malicious files that are sent via email attachments. Although these threats are still very present (for example with various ransomware variants ), cybercriminals also use many other attack methods. Some of the most dangerous are scripted. These are particularly difficult for users to recognize.

How do malicious codes work?

Malicious codes are code fragments that are hidden in otherwise legitimate websites - that is, they have been able to bypass the site's security barriers. They're perfect baits that don't seem suspicious because victims assume they're visiting a trusted site. Cybercriminals can execute malicious code on users' systems by exploiting some security flaws in browsers, in the operating system itself, or in third-party applications.

Current examples show that cybercriminals have been using known exploit kits for years to automate infection processes. The way they operate is relatively simple - bypassing the security of a legitimate website (or creating a malicious website and then redirecting users from other sites) and installing a known exploit kit. From then on, weak points in the users' systems can be identified and exploited. Website visits can also be automated.

This can be seen in malvertising campaigns, where advertisements are shown on compromised websites that contain malicious code. The cybercriminals gain control of the device by visiting a website. They in turn use this to attack others.

As is so often the case, the fault is JavaScript. The normally obfuscated code is responsible for downloading and executing a payload. This so-called payload is a piece of malicious code that exploits security vulnerabilities and infects the user's system with the malware chosen by the cyber-criminal. As a rule, the user does not notice this entire process when surfing the Internet. Overall, this poses a significant risk.

The reason for such a code to run automatically without user intervention lies in the permissions that are configured in the system. The majority of users work and surf with administrator rights on their Windows system. This is completely unnecessary in most situations in everyday life.

Combined with the poor configuration of security measures in the Windows system, such as User Account Control (UAC), this enables malicious codes to compromise hundreds of thousands of computers every day.

Many of the infections via JavaScript could be prevented if users set their security settings to medium/high. The Windows message windows that then appear should be read carefully and not simply clicked away with "OK".

This is how you protect yourself from malicious codes

To prevent this type of attack, users need to take into account that there is no such thing as a completely secure website on the internet. As a result, you have to take steps to protect yourself. The most important thing now is to update the operating system and all applications that are particularly susceptible to script attacks. This includes the browser, Flash Player and Java. But sometimes that's not enough. Proactive antivirus software will detect this type of malicious JavaScript - even those using PowerShell.

Conclusion

It is clear that cybercriminals have been using malicious codes for years to spread all kinds of threats such as Trojans, ransomware, and bots. But there are security measures that can at least mitigate the effects of these attacks. You should now take action and first free your Windows user account from administrator rights. The browser security settings can then be adjusted. It is advisable to select a medium or high-security level. This gives you more control over otherwise hidden automatic processes while surfing. It also applies: first think then click.