Hacker's Toolkit Attacks Unpatched Computers - InformationWeek
03:27 PM
7 Key Cloud Security Trends Shaping 2017 & Beyond
Dec 15, 2016
Cloud computing is enabling business transformation as organizations accelerate time to market and ...Read More>>

Hacker's Toolkit Attacks Unpatched Computers

The "smartbomb" toolkit sniffs for seven unpatched vulnerabilities in Internet Explorer and Firefox, then attacks the easiest-to-exploit weakness.

A dirt-cheap, do-it-yourself hacking kit sold by a Russian Web site is being used by more than 1,000 malicious Web sites, a security company said Monday.

Those sites have confiscated hundreds of thousands of computers using the "smartbomb" kit, which sniffs for seven unpatched vulnerabilities in Internet Explorer and Firefox, then attacks the easiest-to-exploit weakness.

For $15 to $20, hackers can buy the "Web Attacker Toolkit," said San Diego-based Websense in an online alert. The tool, which uses a point-and-click interface, can be planted on malicious sites -- or on previously-compromised computers -- to ambush unsuspecting users.

"It puts a bunch of code on a site that not only detects what browser the victim is running, but then selects one of seven different vulnerabilities to exploit, depending on how well patched the browser is," said Dan Hubbard, senior director of security and research at Websense.

Both Firefox and Internet Explorer vulnerabilities are among the seven.

Websense has detected the kit being used about 1,000 sites, which then plant a Trojan horse on vulnerable computers. The Trojan is installed in a silent "drive-by download" that doesn't require any user intervention; in fact, it installs in the background, so the user has no idea her computer has been hacked.

The Trojan can log keystrokes, download additional code, or open backdoors, said Websense.

"What's interesting is that these sites all have an administration console on them with statistics. We've managed to capture a couple of screenshots."

Those screens, posted with Websense's advisory, detail the browsers running on the compromised computers and keep a running tally of the most successful vulnerabilities.

According to the screenshots, the single site that Websense illustrated had attracted 51,896 computers, the bulk of them -- 76 percent, in fact -- running Microsoft Internet Explorer. (About 12 percent ran Firefox; the remainder were unspecified.)

This site, however, only used 4 of the 7 vulnerabilities, all of them directed at IE. The most successful of the quartet as one tagged as MS03-11 to match the security bulletin MS03-011, which published a patch for a bug in Microsoft Virtual Machine in April 2003. The malicious site managed to compromise 1,773 PCs using that three-year-old flaw, a 3.42 percent infection rate.

"And this is just one site," Hubbard said. "Together, these sites have compromised tens if not hundreds of thousands of systems."

The next-most useful vulnerability was dubbed "0-day" (zero-day), but was actually the "createTextRange" bug that was discovered last month and patched April 11 by Microsoft, said Hubbard. That vulnerability was used to compromise 1,507 PCs (2.9 percent success rate).

"Everyone knows they should patch their browsers," said Hubbard, "but this is further evidence that that's not happening as much as it should be."

The trend toward hackers sharing attack code, even selling simpleton software "kits," has been well-documented. Just last week, in fact, McAfee's research labs reported a major increase in the use of rootkits to cloak worms, Trojans, and spyware; the boost is largely due to cut-and-paste-style tools that automatically add rootkit components to other malicious code, Stuart McClure, chief of McAfee's research lab, said in an interview last week.

"The use of multiple vulnerabilities isn't commonplace," added Websense's Hubbard. "But this [toolkit] shows how hackers are becoming more and more organized."

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of November 6, 2016. We'll be talking with the InformationWeek.com editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll