Attacks/Breaches

1/20/2011
05:02 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Crimeware Toolkits Driving Most Online Malware

Symantec report connects the dots in rise in malware and easy-to-use crimeware kits

DIY crimeware kits are all the rage -- more than 60 percent of malicious websites use these toolkits to do their dirty work, while the other 40 percent are suspected of doing so, according to a new report from Symantec.

And while the kits aren't exactly point-and-click, they do lower the bar for less technical bad guys to get into cybercrime. "In the past, there were guys who were really good with computers that would engage in cybercrime. With these [crimeware] kits, we are seeing the reverse. You've now got guys who are criminals being able to move into the cybercrime field," says Marc Fossi, manager of development for security technology and response at Symantec, and author of the new "Symantec Report on Attack Kits and Malicious Websites," which analyzed a snapshot of attack data collected by Symantec tools between July 1, 2009, and June 30, 2010, to quantify the crimeware activity.

The kits historically helped computer-savvy bad guys become criminals, and now they are helping more seasoned criminals become cybercriminals, he says. "These kits are now far more accessible ... and are pretty easy to use," he says.

Symantec is seeing these kits more in use now than ever before. "Almost two-thirds of the activity on malicious websites could be [definitely] attributed to these kits," he says.

These easy-to-use and access crimeware kits are part of the reason cybercrime is on the rise: According to the report, the Zeus crimeware kit had 90,000 unique variants as of August 2009, and is suspected to be responsible for infecting millions of machines.

But the turning point for these kits was MPack, which was the first crimeware kit that was sold for profit, according to Fossi. "But one of the problems with it was it was done as a script. It's easy for people to copy scripts, change them a bit, and resell them as their own kit. So you saw a lot of kit piracy," he says.

New crimeware kits often come with anti-piracy features much like commercial software. "You can only install them on a limited number of domains," he says.

High-end kits are priced in the thousands of dollars, and often come with icon-driven interfaces, support contracts that include email support, bug fixes, and other services. "It's a very professional model," Fossi says. Just one Zeus ring in the U.S. made $70 million during an 18-month period, he says.

Symantec says most exploits incorporated into crimeware kits are not using zero-day bugs. "Exploits being included in these kits are tied to publicly available exploits," Fossi says.

The full report is available here for download.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Mozilla, Internet Society and Others Pressure Retailers to Demand Secure IoT Products
Curtis Franklin Jr., Senior Editor at Dark Reading,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7629
PUBLISHED: 2019-02-18
Stack-based buffer overflow in the strip_vt102_codes function in TinTin++ 2.01.6 and WinTin++ 2.01.6 allows remote attackers to execute arbitrary code by sending a long message to the client.
CVE-2019-8919
PUBLISHED: 2019-02-18
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2019-8917
PUBLISHED: 2019-02-18
SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote, unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may b...
CVE-2019-8908
PUBLISHED: 2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/g...
CVE-2019-8909
PUBLISHED: 2019-02-18
An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image.