IonCube encoding on the Blackhole Exploit PHP scripts These kits are specifically designed to target vulnerabilities in unpatched system that may be in Java, Adobe Reader or an unpatched installation of Flash.
Blackhole Exploit kit obfuscated Javascripts targeting vulnerabilities Functional Analysis Now the question arises, what makes these kits exploit and compromise our systems? The procedure is fairly simple. Firstly, a victim visits a malicious website hosted on hacker-owned machine, which gives him the freedom to play with the security of the website. Once a victim visits this malicious website, he is redirected through various intermediary servers and finally lands on a malicious server hosting the exploit kit. Then follows a scanning phase by the exploit kit on the victim’s system to scan for known vulnerabilities. Once a vulnerability is found, an exploit/payload effecting that particular vulnerability is downloaded on the victim’s machine and executed in the background.
Let us take a very simple example of a machine having windows XP version with the SMB service running. The exploit kit will simply detect this vulnerable service and drop a payload like a reverse TCP on the victim’s machine. The payload will be executed in the background and yay! We have a reverse connection to the victim’s system. To have better understanding of this technique, I would suggest you to try out the Netapi exploit on Windows XP using Metasploit —also known as ms08_067_netapi. How it all started The roots of software exploitation start a long time ago. The techniques were made better over time and now it is offered as a package of exploits known as the Exploit Kit. These exploit kits are available on the underground market (Deep Web) or in some instances on the World Wide Web. The black hats, script kiddies particularly, and criminals use these exploits to compromise thousands of people, maybe setup a botnet spreading malware, or just for the fun of it. A report by Kaspersky Labs states that MPack was one of the first publicly available exploit kits in 2006 made by the Russian cyber-warriors. This was basically a collection of PHP scripts aimed at exploiting simple vulnerabilities that may be present in the client software. There was a boom in the number of compromised systems just after this kit went viral.
Price Model for Blackhole v1.0.0 Coming back to our modern day exploit kits, the trend has certainly improved and these kits have become more difficult to detect just due to the antivirus evasion techniques they use. Nowadays, these exploit kits come in an easy to use interface in which the user does not need to work hard to actually learn how to use it. It is as simple as a click-click scenario, and you are good to go! These kits usually have a web interface that gives a view of how the kit is functioning and the statistics of infections. There have been kits that offer customer support on its license for six months to a year. Major developments to these kits occur in the underground cyber-market of China and Russia.
Blackhole Exploit Kit Interface
Back to the Blackhole Exploit kits. Symantec recently had a security advisory in which they published the functional analysis of this kit. It was stated that the Blackhole used an obfuscation technique to muddy the exploits. The page contains a large array inside the