Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/8/2013
04:07 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Blackhole' Activity Dips Amid Reports Of Bust

Reports point to possible arrest of Blackhole crimeware author, but changing of the guard is already under way as other kits gain a foothold

The silence has been deafening out of Russia since the reported arrest of the author of the infamous Blackhole exploit kit -- no official announcement came of a bust akin to how botnet takedowns or indictments are typically trumpeted here in the U.S. Meanwhile, security researchers have noticed gaps in Blackhole activity during the past couple of days that appear to corroborate a disruption in the crimeware kit's operations.

Word got out yesterday via social media that "Paunch," the Russian malware writer behind the popular and user-friendly Blackhole exploit kit, had been apprehended in Russia. TechWeek Europe today reported that Troels Oerting, head of the European Cybercrime Centre, confirmed there had been an arrest, but he wouldn't elaborate.

Some security researchers say they've witnessed chatter about Paunch's arrest in underground forums, and one source who requested anonymity confirmed the arrest. Arrests of cybercriminals are still relatively rare, especially in Russia, where cybercrime organizations are known to operate relatively freely as long as they don't target their own citizens. So the prospect of the bust of a major player in cybercrime is big news: "This speaks volumes that this is now viewed as an international problem," says Will Gragido, senior manager of RSA First Watch. "I don't know where the arrest originated, but what I read within the forums was that it was orchestrated out of the Russian Federation. So that's pretty significant" if it proves to be true, he says.

Tom Kellermann, vice president of cybersecurity at Trend Micro, says the reported arrest bodes well for improved cooperation among global law enforcement agencies. "This indictment speaks volumes to the organization of the shadow economy," Kellermann says. "This unprecedented collaboration has been years in the making. Interpol and Europol have stepped up their game."

Among the signs that something's up: The service that encrypts the Blackhole exploit kit, crypt.am, had gone offline and remains so as of this post, and Sophos noticed a rare decline in Blackhole infection detections in its lab during the past 24 hours or so since word of an arrest broke. "We did see a decline in detections, which is abnormal," says Chester Wisniewski, senior security adviser at Sophos.

RSA's Gragido says the fact crypt.am is down is significant. "[Crypt.am] allows you to encrypt the Blackhole exploit kit," he says. "That it's not been updated in two or four days is pretty telling. It had been updated on a daily basis since the arrival of Blackhole on the open market."

Blackhole has been a mainstay in malware since it first emerged on the scene nearly two years ago. The crimeware kit serves up browser-based exploits via infected websites, with the ultimate goal of planting ransomware, financial data-stealing Trojans, or other malware on machines that visit the sites. "Blackhole gave virtually anyone the ability to become a botnet master. When you stop to think about it, it's pretty powerful and probably more ubiquitous than its competitors because it was easy to manipulate," Gragido says.

[Tales from the trenches show that even small organizations are in the bull's eye . See 5 Lessons From Real-World Attacks .]

So what does a bust mean for Blackhole? Customers who rent the kit won't get updates, so their exploits eventually will become "stale," says Jerome Segura, a senior security researcher at Malwarebytes, who today also confirmed that crypt.am was down.

The dip in threats may provide only a very temporary respite in kit-driven cybercrime attacks as Blackhole cybercriminal customers move their businesses to other crimeware kits. Like a botnet takedown, the decline will be short-lived; the bad guys will just retrench and re-emerge elsewhere. According to a French security researcher known as Kafeine, the Reveton ransomware gang was seen migrating away from another of Paunch's malware kits, Cool EK, to a Whitehole exploit kit.

"The interesting thing about this is if, in fact, [Paunch] was arrested, we are going to see a surge in the use of other kits in lieu" of Blackhole, Gragido says. Cool, Stix, and Poison Ivy are prime candidates, he says. And older tools like Liberty and Eleonore could re-emerge, he says.

Even so, Blackhole had lost some "market share" during the past few months to other kits. Sophos' Wisniewski says last year Blackhole made up about 70 percent of infections in websites -- No. 1 -- but today it's somewhere around the fourth or fifth most common infection of websites.

As of August, Blackhole and sister Cool made up only 4 percent of website infections, according to new data released today by Sophos, and had dropped to just 2 percent during the past seven days. Glazunov/Sibhost (48 percent) is now leading the pack by far, followed by Neutrino (35 percent), Stix (3 percent), Sweet Orange (3 percent), and Cool (2 percent). Whitehole is responsible for 1 percent of website infections.

Wisniewski says Blackhole has basically been a victim of its own success. "Any time we see successful criminal techniques, you see other criminals come in and improve on it," he says. "Blackhole was the first exploit-as-a-service ... people buying it loved it, and it was always up to date with the latest exploit. But you saw a lot of copycats."

Curt Wilson, ASERT research analyst with Arbor, says exploit kits are a key component in the cybercrime economy. Even with new crimeware kits taking center stage, there are ways to defend against them, including "robust" patching of applications-- especially major targets like Java and Adobe Acrobat and Reader -- and Microsoft's EMET tool, as well as network monitoring.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Deliver a Deadly Counterpunch to Ransomware Attacks: 4 Steps
Mathew Newfield, Chief Information Security Officer at Unisys,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.