BlackHole more persistent after upgrade

Powered by SC Magazine
 

The authors of the crimeware application are toying with a "pseudo-random domain" generation capability so that victims make it to the malware.

The authors of the BlackHole exploit toolkit have updated their creation to include new functionality that will automatically redirect users from a compromised website to one that serves the malware, according to researchers at Symantec.

The problem for BlackHole's creators has been when users visit a hacked website containing a JavaScript-enabled IFRAME that doesn't link to any malware.

"If the location or URL for the IFRAME, which actually contains the malicious code, changes or is taken down, all of the compromised sites will have to be updated to point to this new location," Nick Johnston, a senior software engineer, wrote in a Symantec blog post that was updated Thursday. "This process is difficult and impractical."

That's where a new capability known as "pseudo-random domains" comes into play. The JavaScript code contained on the initial site that victims visit, typically in a drive-by download scenario, is programmed to create and point to other URLs based on certain factors.

"Once the domain has been generated and the IFRAME has been created, the exploit kit page runs many exploits as normal, going to great lengths to determine, for example, which compromised PDF file to show, depending on the version of Adobe Reader installed," he wrote.

BlackHole is a crimeware application that helps hackers take advantage of software vulnerabilities in order to install malware.

The feature currently is in test mode, but researchers expect it to soon be adopted more widely.

"So far we have seen a small but steady stream of compromised domains using this technique. This suggests that this is perhaps some kind of trial or test that could be expanded in future," Johnston said. "Botnet software has used similar techniques in the past -- Storm most famously -- but use of this technique in web exploit kits is an emerging technique."

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


BlackHole more persistent after upgrade
 
 
 
Top Stories
Slow progress in Turnbullistan
[Blog post] How has the NBN moved ahead since regime change?
 
Hacks and frauds can't dampen Bitcoin buzz
[Blog post] Enthusiasts meet in Melbourne.
 
Qantas checks in with cloud computing
Impressed with results of public cloud bake-off.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  24%
 
Application integration concerns
  2%
 
Security and compliance concerns
  31%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  24%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 560

Vote