Attacks/Breaches
10/14/2011
11:09 AM
Connect Directly
RSS
E-Mail
50%
50%

Blackhole Crimeware Goes 'Prime Time'

New HP OfficeJet phishing emails peaked at around 36,000 per minute on Wednesday.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Attackers are increasingly using the Blackhole exploit kit in phishing campaigns: Most recently, one that poses as an email notification from an HP OfficeJet Printer has sent nearly 8 million emails thus far and uses 2,000 domains to serve up the malware.

Researchers at AppRiver say the trend demonstrates how Blackhole is following the pattern of popular crimeware kit Zeus and SpyEye. Blackhole traditionally has been used to infect legitimate websites for drive-by infection purposes. "This attack is unique because Blackhole added an email vector to its format and is flooding the Internet with similar methods used by Zeus, SpyEye, and others, essentially moving it into prime time," said Fred Touchette, senior security analyst for AppRiver. The attackers also have set up their own malicious links to infect users who click on URLs in the emails.

Blackhole, which previously had been marketed as a high-end crimeware tool, costing $1,500 for a one-year license, in May was unleashed for free in some underground forums. That has propelled more use of the toolkit.

Touchette said he first noticed the trend with a Steve Jobs-themed email campaign earlier this month in the wake of Jobs' death. "This is the first that I have personally noticed that leads email recipients to Blackhole websites. Before that, people using the Blackhole Kit relied on techniques such as SEO poisoning to lead victims to their sites," he said.

The OfficeJet email campaign, like other Blackhole attacks, is trolling for victims' online banking credentials. It works a lot like Zeus and others, using browser vulnerabilities on victims' machines and creating a backdoor for downloading and installing the Trojans. AppRiver's Touchette said Blackhole appears to favor Java and Adobe bugs.

"This most recent campaign is still trickling in, but will soon stall as most of its domains have been picked up and blacklisted by security professionals. At its peak yesterday, we were seeing malicious emails related to this campaign coming in at a rate of around 36,000 per minute," he said. "Links within those emails pointed toward approximately 2,000 separate domains that were hosting malicious code."

Read the rest of this article on Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.