An exploit kit is a tool used for automatically managing and deploying exploits against a target computer. Exploit kits allow attackers to deliver malware without having advanced knowledge of the exploits being used. Browser exploits are typically used, although they may also include exploits targeting common software, such as Adobe Reader, or the operating system itself. Most kits are written in PHP.[1]

Exploit kits are often sold on the black market, both as standalone kits, and as a service.

History

Some of the first exploit kits were WebAttacker and MPack, both created in 2006. They were sold on black markets, enabling attackers to use exploits without advanced knowledge of computer security.[2][3]

The Blackhole exploit kit was released in 2010, and could either be purchased outright, or rented for a fee.[4] Malwarebytes stated that Blackhole was the primary method of delivering malware in 2012 and much of 2013.[5] After the arrest of the authors in late 2013, use of the kit sharply declined.[5][6][7]

Neutrino was first detected in 2012,[8] and was used in a number of ransomware campaigns. It exploited vulnerabilities in Adobe Reader, the Java Runtime Environment, and Adobe Flash.[9] Following a joint-operation between Cisco Talos and GoDaddy to disrupt a Neutrino malvertising campaign,[10] the authors stopped selling the kit, deciding to only provide support and updates to previous clients. Despite this, development of the kit continued, and new exploits were added.[11] As of April 2017, Neutrino activity ceased.[12] On June 15, 2017, F-Secure tweeted "R.I.P. Neutrino exploit kit. We'll miss you (not)." with a graph showing the complete decline of Neutrino detections.[13]

From 2017 onwards, the usage of exploit kits has dwindled. There are a number of factors which may have caused this, including arrests of cybercriminals, improvements in security making exploitation harder, and cybercriminals turning to other method of malware delivery, such as Microsoft Office macros and social engineering.[14]

There are many systems that work to protect against attacks from exploit kits. These include gateway anti-virus, intrusion prevention, and anti-spyware. There are also ways for subscribers to receive these prevention systems on a continuous basis, which helps them to better defend themselves against attacks.[15]

Overview

Exploitation process

The general process of exploitation by an exploit kit is as follows:

  1. The victim navigates to a website infected by an exploit kit. Links to infected pages can be spread via spam, malvertising, or by compromising legitimate sites.
  2. The victim is redirected to the landing page of the exploit kit.
  3. The exploit kit determines which vulnerabilities are present, and which exploit to deploy against the target.
  4. The exploit is deployed. If successful, a payload of the attacker's choosing (i.e. malware) can then be deployed on the target.[1][16]

Features

Exploit kits employ a variety of evasion techniques to avoid detection. Some of these techniques include obfuscating the code,[17] and using fingerprinting to ensure malicious content is only delivered to likely targets.[18][1]

Modern exploit kits include features such as web interfaces and statistics, tracking the number of visitors and victims.[1]

See also

References

  1. ^ a b c d Cannell, Joshua (11 February 2013). "Tools of the Trade: Exploit Kits". Malwarebytes Labs. Retrieved 8 April 2022.
  2. ^ Chen, Joseph; Li, Brooks. "Evolution of Exploit Kits" (PDF). Trend Micro. Retrieved 8 April 2022.
  3. ^ "Markets for Cybercrime Tools and Stolen Data" (PDF). RAND Corporation. 2014.
  4. ^ "Blackhole malware exploit kit suspect arrested". BBC News. 9 October 2013. Retrieved 8 April 2022.
  5. ^ a b Kujawa, Adam (4 December 2013). "Malwarebytes 2013 Threat Report". Malwarebytes Labs. Retrieved 8 April 2022.
  6. ^ Zorabedian, John (9 October 2013). "Is the Blackhole exploit kit finished?". Sophos News. Retrieved 3 April 2022.
  7. ^ Fisher, Dennis. "Blackhole and Cool Exploit Kits Nearly Extinct". threatpost.com. Retrieved 3 April 2022.
  8. ^ "Neutrino Exploit kit: A walk-through into the exploit kit's campaigns distributing various ransomware". Cyware Labs. Retrieved 8 April 2022.
  9. ^ "Neutrino". Malwarebytes Labs. Retrieved 8 April 2022.
  10. ^ "Malvertising Campaign Pushing Neutrino Exploit Kit Shut Down". threatpost.com. Retrieved 8 April 2022.
  11. ^ "Former Major Player Neutrino Exploit Kit Has Gone Dark". Bleeping Computer. Retrieved 8 April 2022.
  12. ^ Schwartz, Mathew (15 June 2017). "Neutrino Exploit Kit: No Signs of Life". www.bankinfosecurity.com. Retrieved 8 April 2022.
  13. ^ F-Secure [@FSLabs] (15 June 2017). "R.I.P. Neutrino exploit kit. We'll miss you (not)" (Tweet) – via Twitter.
  14. ^ "Where Have All The Exploit Kits Gone?". threatpost.com. Retrieved 8 April 2022.
  15. ^ Malecki, Florian (June 2013). "Defending your business from exploit kits". Computer Fraud & Security. 2013 (6): 19–20. doi:10.1016/S1361-3723(13)70056-3.
  16. ^ "exploit kit - Definition". Trend Micro. Retrieved 8 April 2022.
  17. ^ "Exploit Kits Improve Evasion Techniques". McAfee Blog. 12 November 2014. Retrieved 8 April 2022.
  18. ^ "Angler Exploit Kit Continues to Evade Detection: Over 90,000 Websites Compromised". Unit42. 11 January 2016. Retrieved 8 April 2022.
Categories