Cyber Crime and Cyber Terrorism

236
CHAPTER 17
Responding to cyber crime and cyber terrorism
The whole purpose of Blackhole is to infect victims with some payload. The pay-
loads are typically polymorphic, packed with custom encryption tools and designed 
to evade antivirus detection (a process which is helped with the built-in AV checking 
functionality of Blackhole). The most prevalent payloads installed in the past few 
years include fake AV, Zeus, ZeroAccess rootkit and Ransomware.
One of the most important new features of Blackhole is the automation through 
which you can exploit servers and clients by a large amount of vulnerabilities (re-
member that both Zeus and Blackhole are networks constantly managed and updated 
remotely). Web Servers with some vulnerability (compromised servers) may be used 
to host Blackhole directly or to redirect clients toward “ad-hoc-builded” Blackhole 
Web Sites.
An attacker can use a compromised server in order to steal information of 
all users of the same server also known as a Watering Hole attack. The attackers 
study the behavior of people who work for a target organization, to learn about 
their browsing habits. Then they compromise a web site that is frequently used by 
employees—preferably one hosted by a trusted organization which represents a 
valuable source of information. Ideally, they will use a zero-day exploit. So when 
an employee visits a web page on the site, they are infected, typically a backdoor 
Trojan is installed allowing the attackers to access the company’s internal network. 
In effect, instead of chasing the victim, the cybercriminal sits in a location that 
the victim is highly likely to visit—hence the watering-hole analogy (
Kaspersky, 
2013
; 
Symantec, 2013
).
The other important aspect, from the criminal point of view, is the change of the 
criminal business model. Older versions of malware were offered for sale at very