Cyber Crime and Cyber Terrorism

234
CHAPTER 17
Responding to cyber crime and cyber terrorism
Connect to an IRC
Channel
Runs customs
scripts
Responde to IRC
events
Accesses raw
TCP and UDP
sockets
Single small binary
written in C
++
Logs keystrokes
Sends out spam
Spreads via spam
Sends out spam
Aka Ozdok
Responsibel for 30-35%
of world’s spam
Generates 50,000
alternative C&C server
names per day
Sends out spam on social
networking sites
Writes malicious posts on
user’s walls
Specifically targets some
security
vendors/researchers
Instigates DDOS attacks
Aka Pushdo/Pandex
Sends out spam
Aka Cbeplay/Exchanger
Sends out spam
Steals banking-
related and other
financial data
Mines data
Sends out spam
Uses compression and
encryption algorithms
Tries to evade detection
First P2P botnet
Uses polimorphism
First spam botnet
Blend of MyDoom and
SDBot
Commercialized by
creator
Sequentially delivers
payloads via modular
staged attacks
1999
2000
2002
2003
2006
2007
2008
Listen to maliciuos
commands
Sub7
and
Pretty Park
Gtbot
SDBot
Spybot
RuStock
Zeus
Storm
ASProx
Mega-D
Conficker
KOOBFACE
Cutwail
Srizbi
Rbot
Sinit/Calypso
Polybot
Bagle and
Bobax
Mytob
Agobot
FIGURE 17.1
Botnets roadmap.

---

235
 
A botnet roadmap
Just as Zeus was the cornerstone of the next-generation botnets, Blackhole is 
definitely the cornerstone of the next-generation exploit kits. Since it emerged in 
late 2010, the Blackhole exploit kit has grown to become one of the most notorious 
exploit kits ever encountered (
Howard, 2012
).
Over the last few years the volume of malware seen in the field has grown dra-
matically, thanks mostly to the use of automation and kits to facilitate its creation and 
distribution. The term “crimeware,” already used for Zeus, was coined specifically 
to describe the process of “automating cybercrime.” Individuals no longer profit just 
from writing and distributing their malware. Today’s malware scene is highly orga-
nized, structured and professional in its approach, where individuals can choose the 
criminal role which best fit.
Kits, as an intrinsic part of crimeware, provide the tools for criminals to create 
and distribute malware, but also the systems used to manage networks of infected 
machines. Some of these kits focus on creation and management of the malware 
payload—Zeus is perhaps the best example of this. Other kits are those that focus on 
infecting users through web attacks, specifically attacks known as drive-by down-
loads. It is this latter group of kits that are commonly referred to as exploit kits or 
exploit packs (the terms are used interchangeably).
There are several versions of Blackhole exploit kit, the first being v1.0.0 (released 
in late 2010). The kit consists of a series of PHP scripts designed to run on a web 
server (all protected with the commercial ionCube encoder). This is presumably to 
help prevent other miscreants stealing their code (there are many exploit kits which 
are little more than copies of others), and to hinder analysis.
The general characteristics of the Blackhole exploit kit are listed below:
• The kit is Russian in origin.
• Configuration options for all the usual parameters (querystring parameters, file paths 
for payloads or exploit components, redirect URLs, usernames, passwords, etc.).
• MySQL backend.
• Blacklisting/blocking (only hit any IP once, maintain IP blacklist, blacklist by 
referrer URL, import blacklisted ranges).
• Auto update (of course).
• Management console provides statistical summary, breaking down successful 
infections by exploit, OS, country, affiliate/partner (responsible for directing 
user traffic to the exploit kit) and by browser.
• Targets a variety of client vulnerabilities.
• Antivirus scanning add-ons.
However, there are some features that are (or were at first release) unique to Blackhole:
• “Rental” business model. Historically, exploit kits are goods (pay-per-use) 
that are sold to individuals and then used as they desire. Blackhole includes a 
rental strategy, where individuals pay for the use of the hosted exploit kit for 
some period of time. 
Figure 17.2
illustrates the pricing model (translated from 
Russian) for the first release of Blackhole.
• Management console optimized for use with PDAs.

---