Are you digitally challenged? Don’t know a byte from a bit? Have a limited command of Unix? Don’t worry: With a new generation of professionally packaged exploit kits, you, too, can become a successful cyber criminal.
New attack kits, which package proven exploits for vulnerabilities in popular software for easy installation and management, are bringing cyber crime to a new generation of criminals who have only limited technical skills, according to a new report from M86 Security.
The existence of exploit kits, which date back to at least 2006, is no secret. But they are becoming increasingly user-friendly, lowering the bar for entry to the cyber underground and creating a new source of revenue for the coders and hackers who devise them. One such kit, the Eleonore Exploit Pack, apparently was used in recent attacks on three Treasury Department sites.
“Cyber criminals find it easier, faster and more cost-effective to make money by buying exploits rather than taking the time to create exploits themselves,” states the report, titled “Web Exploits: There’s an App for That.”
Browser vulnerabilities usually are the most common targets for the kits. But M86 reported that exploits for vulnerabilities in Adobe Flash, Java and PDF are on the rise. The kits are designed for easy installation on a Web server and are linked to a database for logging and reporting.
Reporting can be critical because the kits can be used to distribute pay-per-install code, for which the kit owner is paid to install third-party malware on compromised computers. Rates range from a modest $50 per 1,000 installs on European and Australian computers to a healthy $170 per 1,000 U.S. computers.
The criminals can drive victim traffic to the exploit Web page with techniques such as spam that contains malicious links or by setting up a bogus Web site and using search engine optimization to popularize it. But the most common technique is to inject malicious iFrames into legitimate sites and redirect traffic to the exploit page. Some entrepreneurs will even sell redirected Web traffic at a reasonable rate.
But don’t get any ideas about reselling these exploit kits. These guys might be criminals, but they don’t tolerate piracy. “You are not allowed to resell/share, if we catch you doing this your license will be revoked,” the purveyors of Crimepack warn.
0 Visitor Reactions & Comments: