BlackHole more persistent after upgrade

Powered by SC Magazine
 

The authors of the crimeware application are toying with a "pseudo-random domain" generation capability so that victims make it to the malware.

The authors of the BlackHole exploit toolkit have updated their creation to include new functionality that will automatically redirect users from a compromised website to one that serves the malware, according to researchers at Symantec.

The problem for BlackHole's creators has been when users visit a hacked website containing a JavaScript-enabled IFRAME that doesn't link to any malware.

"If the location or URL for the IFRAME, which actually contains the malicious code, changes or is taken down, all of the compromised sites will have to be updated to point to this new location," Nick Johnston, a senior software engineer, wrote in a Symantec blog post that was updated Thursday. "This process is difficult and impractical."

That's where a new capability known as "pseudo-random domains" comes into play. The JavaScript code contained on the initial site that victims visit, typically in a drive-by download scenario, is programmed to create and point to other URLs based on certain factors.

"Once the domain has been generated and the IFRAME has been created, the exploit kit page runs many exploits as normal, going to great lengths to determine, for example, which compromised PDF file to show, depending on the version of Adobe Reader installed," he wrote.

BlackHole is a crimeware application that helps hackers take advantage of software vulnerabilities in order to install malware.

The feature currently is in test mode, but researchers expect it to soon be adopted more widely.

"So far we have seen a small but steady stream of compromised domains using this technique. This suggests that this is perhaps some kind of trial or test that could be expanded in future," Johnston said. "Botnet software has used similar techniques in the past -- Storm most famously -- but use of this technique in web exploit kits is an emerging technique."

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


BlackHole more persistent after upgrade
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 337

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 140

Vote