Feeds

Not Cool, man: Potent new hacking toolkit costs crooks $10k a month

Blackhole gang snap up latest 0-days to build a better mousetrap

Internet Security Threat Report 2014

The brains behind the Blackhole Exploit Kit is using profits from the hacking toolbox to buy up security exploits and create a far more formidable product.

The ubiquitous Blackhole kit is usually installed on compromised websites and uses vulnerabilities in web browsers and other software to inject malware into visitors' PCs.

It is widely available through underground forums, and is affordable and reliable. Access to the technology is rented out for about $700 a quarter or $1,500 for a year, often bundled with web hosting fees of $500 a month, according to an investigation by Sophos.

Paunch, the main author of Blackhole, is now buying up code that exploits software security bugs from hackers and researchers to craft a far more powerful toolkit. Dubbed "Cool", this toolbox is available at a hefty $10,000 a month and is linked to a recent wave of successful online attacks.

The Cool Exploit Kit pack first surfaced in October and was used to push ransomware, which typically demands a victim to pay a fee to unlock his or her compromised computer. A French security researcher going by the name of Kafeine was among the first to notice the Cool kit using a critical vulnerability in Microsoft Windows (CVE-2011-3402). The flaw in the operating system's font processing code was first exploited by the cyber-espionage worm Duqu. That attack was added to the toolkit about a week later.

The same sequence of events happened with a Java runtime vulnerability (CVE-2012-5076) first abused by Cool mid-November, and later bundled in Blackhole. An analysis by F-Secure revealed similarities in the programming and functionality of the two exploit kits, which was further evidence that they were created by the same author or team.

Paunch admitted he created the Cool Exploit kit in an interview with investigative journalist Brian Krebs, and said his exploit framework costs $10,000 a month. "At first I thought Paunch might be pulling my leg, but that price tag was confirmed in a discussion by members of a very exclusive underground forum," Krebs noted.

An associate of Paunch posted a request for attack code on an underground cybercrime forum, and boasted that the group had a budget of $100,000 to buy exploits for unpatched web browser security bugs, as well as details of other undisclosed software flaws and tactics for improving the success rates of online assaults.

A portion of that message board post, translated from Russian by a professional translator, can be read on Krebs' website. The blogger concluded that the gang led by Paunch has moved on from exploiting vulnerabilities known to vendors, and likely patched by users, to relying on flaws that have not yet been disclosed to software makers - a dangerous development for web surfers and an expensive business for Paunch: getting hold of these so-called zero-day vulnerabilities is not cheap.

The Cool Exploit kit is been used by the Reveton ransomware gang. Symantec recently obtained access to a control panel and uncovered evidence [PDF] that the group was earning $30,000 A DAY through the scam, more than enough to justify the hefty outlay of an elite exploit pack. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.