Vulnerabilities / Threats

1/8/2013
02:53 PM
50%
50%

Blackhole Botnet Creator Buys Up Zero Day Exploits

Crimeware toolkit is apparently so successful that creator been given $100,000 to shop for the latest vulnerabilities.

The gang behind the Blackhole crimeware toolkit has earned so much money from renting the malicious software that its creator has been given $100,000 to procure the best Web browser exploits and zero-day flaws.

That finding was first reported by security journalist Brian Krebs, who discovered the information in a post made on an underground, Russian-language cybercrime forum by an associate of "Paunch," the creator of Blackhole.

"We are setting aside a $100K budget to purchase browser and browser plug-in vulnerabilities, which are going to be used exclusively by us, without being released to public (not counting the situations, when a vulnerability is made public not because of us)," according to a translation of the post published by Krebs. "Not only do we purchase weaponized (ready) exploits, but also their descriptions and proof of concepts (with subsequent joint work with our specialists)."

The Blackhole toolkit is used to infect legitimate websites with malicious code, after which the infected website can be used to launch drive-by attacks that target browser vulnerabilities and then compromise the underlying PC. From there, attackers can steal login credentials for financial websites, make the PCs serve as spam relays or press the PCs into service as part of a botnet.

[ From Muslim bank hacktivists to major hacker busts, 2012 was a busy year for security experts. See what's ahead; read 7 Top Information Security Trends For 2013. ]

Blackhole isn't available to buy. Rather, it can only be rented for about $50 per day, $700 for three months or $1,500 for one year.

Success in the crimeware toolkit market is predicated on selling -- or in the case of Blackhole, renting -- software that successfully infects as many PCs as possible in the shortest possible amount of time. Accordingly, the most successful crimeware creators tend to rapidly add exploits for the latest known vulnerabilities to their software to help their buyers or subscribers compromise more PCs, thus maximizing their potential illicit revenue.

Not surprisingly, the gang behind the Blackhole toolkit regularly updates the software to allow it to exploit the latest zero-day flaws. Last year, for example, an exploit for a Java zero-day vulnerability was added to Blackhole less than 12 hours after the bug was first detailed publicly. The severity of the flaw and as its inclusion in a crimeware toolkit -- as well as in the open source Metasploit framework -- led security experts to recommend that Java be deactivated on all PCs, pending a fix from Oracle.

Blackhole's creator, Paunch, last year told Krebs via IM that the one exploit could have been worth $100,000 if sold on the zero-day vulnerability market. As that suggests, Paunch already seemed to have a familiarity with the buying and selling of zero-day vulnerability information.

Evidence that Blackhole has been paying off handsomely for its creators comes not just from Paunch's apparent $100,000 zero-day vulnerability budget, but also from the fact that the Blackhole gang now rents not just the basic version of the crimeware toolkit, but also a $10,000 per month exploit pack called the Cool Exploit Kit, which first began appearing in October 2012. So far, the pricey exploit pack has only been used by two ransomware criminal gangs, according to researchers. In particular, one of the gangs has been launching Raveton malware attacks that lock people's PCs, then demand the user pay a fine, supposedly to the FBI or another government agency. In reality, the money goes into the criminals' coffers.

In the case of Cool, the exploit pack last year included an innovative Windows vulnerability that first appeared in Duqu, according to a French information security researcher known as "Kafeine." Duqu was reportedly the product of a U.S. cyber-weapons program, thus illustrating that yesterday's espionage tool quickly becomes the inspiration for today's cybercrime malware.

Indeed, speaking recently by phone, Bit9 CTO Harry Sverdlove warned that one side effect of government-commissioned espionage malware is that it helps criminals rapidly advance the state of the art of their own malicious code. "It raises the bar for everyone -- the techniques, if not the source code," he said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
1/9/2013 | 6:49:07 PM
re: Blackhole Botnet Creator Buys Up Zero Day Exploits
Great question. The money often leads to Russia or former Soviet satellites. At least in the case of Russia, there seems to be an agreement between authorities and cybercrime gangs--and crimeware toolkit developers--that as long as they don't attack people in Russia, and agree to do the occasional favor for the Russian government, they can operate with impunity.

--Mathew Schwartz, InformationWeek
TerryB
50%
50%
TerryB,
User Rank: Ninja
1/9/2013 | 6:16:07 PM
re: Blackhole Botnet Creator Buys Up Zero Day Exploits
I don't understand how these guys collect their payments? Doesn't "following the money" take authorities right to the criminals? Or do they somehow collect cash payments for "rent"?
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
A Call for Greater Regulation of Digital Currencies
Kelly Sheridan, Associate Editor, Dark Reading,  11/21/2017
New OWASP Top 10 List Includes Three New Web Vulns
Jai Vijayan, Freelance writer,  11/21/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.