BlackHole more persistent after upgrade

By on
BlackHole more persistent after upgrade

The authors of the crimeware application are toying with a "pseudo-random domain" generation capability so that victims make it to the malware.

The authors of the BlackHole exploit toolkit have updated their creation to include new functionality that will automatically redirect users from a compromised website to one that serves the malware, according to researchers at Symantec.

The problem for BlackHole's creators has been when users visit a hacked website containing a JavaScript-enabled IFRAME that doesn't link to any malware.

"If the location or URL for the IFRAME, which actually contains the malicious code, changes or is taken down, all of the compromised sites will have to be updated to point to this new location," Nick Johnston, a senior software engineer, wrote in a Symantec blog post that was updated Thursday. "This process is difficult and impractical."

That's where a new capability known as "pseudo-random domains" comes into play. The JavaScript code contained on the initial site that victims visit, typically in a drive-by download scenario, is programmed to create and point to other URLs based on certain factors.

"Once the domain has been generated and the IFRAME has been created, the exploit kit page runs many exploits as normal, going to great lengths to determine, for example, which compromised PDF file to show, depending on the version of Adobe Reader installed," he wrote.

BlackHole is a crimeware application that helps hackers take advantage of software vulnerabilities in order to install malware.

The feature currently is in test mode, but researchers expect it to soon be adopted more widely.

"So far we have seen a small but steady stream of compromised domains using this technique. This suggests that this is perhaps some kind of trial or test that could be expanded in future," Johnston said. "Botnet software has used similar techniques in the past -- Storm most famously -- but use of this technique in web exploit kits is an emerging technique."

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

New Windows 10 users, are you upgrading from...
Windows 8
Windows 7
Windows XP
Another operating system
Windows Vista
How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?