The ease-of-use and ability to amass great profits through the use of easily accessible “attack toolkits” are driving faster proliferation of cyber attacks and expanding the pool of attackers.
Symantec today announced the findings of a report on Attack Toolkits and Malicious Websites, revealing that as attack kits become more accessible and relatively easier to use, they are being utilized much more widely.
The ease of use and accessibility of these toolkits have opened the doors to more criminals who would likely otherwise lack the required technical expertise to succeed in the cybercrime underground.
Attack toolkits are software programs that can be used by novices and experts alike to facilitate the launch of widespread attacks on networked computers. These kits enable the attacker to easily launch numerous pre-written threats against computer systems. They also provide the ability to customize threats in order to evade detection, as well as automating the attack process.
“In the past, hackers had to create their own threats from scratch. This complex process limited the number of attackers to a small pool of highly skilled cybercriminals,” said Stephen Trilling, senior vice president, Symantec Security Technology and Response. “Today’s attack toolkits make it relatively easy for even a malicious novice to launch a cyberattack. As a result, we expect to see even more criminal activity in this area and a higher likelihood that the average user will be victimized.”
The relative simplicity and effectiveness of attack kits has contributed to their increased use in cybercrime — these kits are now being used in the majority of malicious Internet attacks.
Perhaps the most popular toolkit, ZeuS, also known as Zbot, WSNPOEM, NTOS and PRG, is the most prevalent banking malware platform for online fraud, and has been licensed by numerous criminal organizations. The program then waits for the user to log onto a list of targeted banks and financial institutions, and then steals login credentials and other data which are immediately sent to a remote server hosted by cybercriminals. It can also modify, in a user’s browser, the genuine web pages from a bank’s web servers to ask for personal information such as payment card number and PIN, one time passwords, etc. A mobile version of Zeus has also emerged.
Technical Reading: Designing Security for Newly Networked Devices
The profitability of malicious code attacks using Zeus was recently illustrated by the September 2010 arrests of a ring of cybercriminals who allegedly used a Zeus botnet in the theft of more than $70 million from online banking and trading accounts over an 18-month period.
As cyber attacks have become more profitable, the popularity of attack kits has dramatically increased. This in turn has led to increasingly robust and sophisticated kits. These kits are now often sold on a subscription-based model with regular updates, components that extend capabilities, and support services. Cybercriminals routinely advertise installation services, rent limited access to kit consoles, and use commercial anti-piracy tools to prevent attackers from using the tools without paying.
Faster Proliferation of Attacks
The speed at which new vulnerabilities and their exploits spread around the globe has increased due to innovations that attack kit developers have integrated into their products. Attack kits are now fairly easy to update, which allows developers to quickly add exploit code for new vulnerabilities. The result is that some exploits are in the wild just days after the associated vulnerability becomes public. Attackers who can easily update their attack kits with recent exploits are able to target potential victims before they apply necessary patches.
Additional Findings shared by Symantec:
• Popularity and demand has driven up the cost of attack kits. In 2006, WebAttacker, a popular attack toolkit, sold for $15 on the underground economy. In 2010, ZeuS 2.0 was advertised for up to $8,000.
• Secondary services have emerged to direct unsuspecting users to malicious websites, where their computers can be compromised. Tactics used include spam campaigns, black hat search engine optimization (SEO), the injection of code into legitimate websites, and malicious advertisements.
• Symantec observed more than 310,000 unique domains that were found to be malicious. On average, this resulted in the detection of more than 4.4 million malicious Web pages per month.
• Of the Web-based threat activity detected by Symantec during the reporting period, 61 percent was attributable to attack kits.
• The most prevalent attack kits are MPack, Neosploit, ZeuS, Nukesploit P4ck, and Phoenix.
• The search terms that most commonly resulted in malicious website visits were for adult entertainment websites, making up 44 percent of the search terms.
Mitigating Attacks
• Organizations and end users should ensure that all software is up-to-date with vendor patches. Asset and patch management solutions may help to ensure systems are compliant and deploy patches to systems that are not up-to-date.
• Organizations should create policies to limit the use of browser software and browser plug-ins that are not required by the users of the organization. This is especially prudent for ActiveX controls, which may be installed without the knowledge of the user.
• Organizations can also benefit from using website reputation and IP black listing solutions to block outgoing access to sites that are known to host attack toolkits and associated threats.
Because attack kits are becoming easier to use, cybercrime is no longer limited to those with advanced programming skills. Participants now include a mix of individuals with computer skills and those with expertise in traditional criminal activities such as money laundering. Symantec expects that this much larger pool of criminals entering the space will lead to an increase in the number of attacks. The full report from Symantec is available here (PDF).
Related Reading – The Increasing Importance of Securing The Smart Grid
