BlackHole more persistent after upgrade

Powered by SC Magazine
 

The authors of the crimeware application are toying with a "pseudo-random domain" generation capability so that victims make it to the malware.

The authors of the BlackHole exploit toolkit have updated their creation to include new functionality that will automatically redirect users from a compromised website to one that serves the malware, according to researchers at Symantec.

The problem for BlackHole's creators has been when users visit a hacked website containing a JavaScript-enabled IFRAME that doesn't link to any malware.

"If the location or URL for the IFRAME, which actually contains the malicious code, changes or is taken down, all of the compromised sites will have to be updated to point to this new location," Nick Johnston, a senior software engineer, wrote in a Symantec blog post that was updated Thursday. "This process is difficult and impractical."

That's where a new capability known as "pseudo-random domains" comes into play. The JavaScript code contained on the initial site that victims visit, typically in a drive-by download scenario, is programmed to create and point to other URLs based on certain factors.

"Once the domain has been generated and the IFRAME has been created, the exploit kit page runs many exploits as normal, going to great lengths to determine, for example, which compromised PDF file to show, depending on the version of Adobe Reader installed," he wrote.

BlackHole is a crimeware application that helps hackers take advantage of software vulnerabilities in order to install malware.

The feature currently is in test mode, but researchers expect it to soon be adopted more widely.

"So far we have seen a small but steady stream of compromised domains using this technique. This suggests that this is perhaps some kind of trial or test that could be expanded in future," Johnston said. "Botnet software has used similar techniques in the past -- Storm most famously -- but use of this technique in web exploit kits is an emerging technique."

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


BlackHole more persistent after upgrade
 
 
 
Top Stories
NBN Co names first 140 FTTN sites
National trial extended.
 
Cloud, big data propel bank CISOs into the boardroom
And this time, they are welcome.
 
Photos: A tour of CommBank's new innovation lab
Oculus Rift, Kinect and more.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  23%
 
End user computing (desktops, mobiles, apps)
  12%
 
Software development
  27%
TOTAL VOTES: 225

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  63%
 
No
  37%
TOTAL VOTES: 67

Vote