Feeds

Neosploit hack-by-numbers kit euthanized

Victim of its own success

SANS - Survey on application security programs

The distributors of Neosploit, one of the most noxious infection kits available on the internet, are retiring the product, citing support costs that didn't justify the expense.

Like MPack, Icepack and others, Neosploit was the hacking equivalent of a paint-by-numbers kit. Miscreants who didn't have the time or skills to fashion their own exploits could buy the kit and amass a sizable botnet in no time. The package was highly scalable, received regular improvements and even came with an online user forum where customers could seek help when they got stuck.

Not anymore.

According to this post from researchers at RSA FraudAction Research Labs, Neosploit is being put out to pasture. RSA cited a notice from the distributors that read:

Unfortunately, supporting our product is no longer possible. We apologize for any inconvenience, but business is business since the amount of time spent on this project does not justify itself.

We tried hard to satisfy our clients' needs during the last few months, but the support had to end at some point. We were 1.5 years with you and hope that this was a good time for your business.

Lest anyone start popping champagne corks or sing "Ding Dong the Witch is Dead," this isn't necessarily good news. For one thing, Neosploit faced stiff competition from the proliferation of competing kits, many of which sold for a fraction of the price, according to Thomas Holt, a professor of criminal justice at the University of North Carolina at Charlotte who researches the malware black market.

What's more, the RSA researchers note that Neosploit may be a victim of its own success.

"It is likely that Neosploit was finding it difficult to sustain its new customer acquisition rate, and that its existing customers were not generating enough revenue to sustain the prior rate of development," they wrote. "These problems appear to have been too much of a burden, and we now believe that the Neosploit development team has been forced to abandon its product."

Anytime there's bang-up business there are sure to be repeats and knockoffs. So brace yourself: This isn't likely to be the last we've heard from these guys. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.