Hackers update malware tool kit with zero-day code
682593
(InfoWorld) - A new version of the IcePack hacker exploit tool kit has been released, security researchers warned Tuesday, and for the first time it includes attack code designed to exploit an unpatched, or zero-day, Microsoft vulnerability. Three of IcePack's eight exploit tools are new, said Roger Thompson, chief technology officer at Exploit Prevention Labs. That's noteworthy in and of itself, Thompson said. "The mix of old and new exploits is to be expected, but three new ones in one update is pretty impressive," he noted. But the new tool kit also sports a first. "The latest iteration has done something original," said Thompson, pointing to an exploit that attacks a zero-day vulnerability in Microsoft's DirectX software development kit (SDK). "The closest to a tool-kit zero-day exploit [before] was for the ANI [animated cursor] vulnerability." He was referring to a Windows bug that surfaced in early April. By the time that Mpack, an IcePack predecessor, added the ANI exploit, however, Microsoft had patched the vulnerability with an emergency out-of-cycle update. The DirectX SDK bug was disclosed by Polish researcher Krystian Kloskowski in a post to the milw0rm.com site in mid-August. Microsoft did not release a fix for the flaw in the regularly scheduled updates issued earlier Tuesday. IcePack is only one of several click-to-attack malware tool kits in circulation. Derived from the earlier Mpack, IcePack joins others boasting monikers such as NeoSploit and WebAttacker that cater to what Thompson called "lazy crooks." "Originally there was just WebAttacker, but they screwed up and then NeoSploit came along," Thompson said as he rattled off the exploit tool kit genealogy. "Then there was Mpack, which everyone at first thought was just WebAttacker, but it wasn't. Now there's IcePack." He estimated that nine to 12 malware tool kits are currently in use. "They all use very similar code, and they're all trying to make a buck out of selling to lazy crooks," said Thompson. Even though the just-updated IcePack features the first zero-day attack code seen in a malware kit, Thompson downplayed the threat. Sort of. "This is not an end-of-the-world kind of thing, since not many people will have the [DirectX] SDK. But no one knows what other software packages use that [vulnerable] ActiveX control. It's a little like Russian roulette that way." Other researchers confirmed Thompson's assessment. Symantec, for instance, warned customers of its DeepSight threat network that it had spotted in-the-wild attacks using the DirectX exploit. Symantec's researchers also confirmed that the other two exploits new to IcePack target vulnerabilities in Yahoo Messenger and Yahoo Widgets. Both of those bugs, however, have been patched. Taking aim at patched vulnerabilities is a common characteristic of multistrike kits, even though it might seem counterintuitive, said Thompson. "They usually go after lesser-known vulnerabilities," he said.
71504
Client Security 7.0 will include what F-Secure calls its DeepGuard rootkit detection to identify hidden malicious code and remove it.
259358
Malicious hackers tout a site with an strip show download to entice victims to download malware.
408824
Well, if you haven&#39;t patched your PC yet, now is the time. A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the
81976
Recently discovered vulnerability allows hackers to use Web graphics to launch attacks.
356031
A new, stealthy attack serves up malicious code only once, making it harder to spot and track.
699435
A researcher has posted proof-of-concept code for a zero-day flaw within Mac OS X dealing with its handling of disk image (.dmg) files. The issue causes a memory corruption vulnerability that could allow attackers to execute arbitrary code.
367211
Days after sample attack code for a yet-to-be-patched flaw surfaced, malicious sites are popping up that exploit the hole.
104025
Less than a day after Microsoft detailed the latest Windows vulnerability, hackers were hunting for exploit codes. By Gregg Keizer, TechWeb News.
760426
It took less than 24 hours for attackers to crank out code targeting a Windows 2000 vulnerability.
458563
Security-minded users can find out faster if their applications need to be patched with a free tool.
274144
(InfoWorld) - They just don't make malware like they used to. Or at least like they did earlier this year. Even low-quality malware, however, is taxing the resources of security companies, since it is being detected in ever-higher numbers. Over the last six months, the technical creativity of malware has fallen along with the ability to cause massive damage, such as that created by the MyDoom and Sasser worms of years past, wrote Alexander Gostev, senior virus analyst for Kaspersky Lab, in a recent report. Gostev's lab intermittently sees highly technical malware, but most is "the same unending stream of Trojans, viruses and worms," he wrote. In many cases, hackers simply take existing malware and create variants, by tweaking the older code to evade antivirus software. At times, the process is simple trial and error. Malware writers use online scanners such as Virustotal , which check to see if their new code will be detected by antivirus software, said Mikko Hypponen, chief research officer for F-Secure. If the code is detectable, they can make a slight modification and run it through the scanner again. "I'd like to tell you that we're winning this war," Hypponen said. "But frankly, I'm not so sure. We need new kinds of solutions." Because much of the code is not new, it tends to remain effective for shorter periods of time before antivirus companies detect it. Still, the time it takes to identify and create a signature for a new virus, which can range from a few minutes to a few hours, is often long enough for hackers to infect computers. "Antivirus companies are working at the limits of their capabilities in terms of speed," Gostev wrote. To be sure, some malicious hackers are doing creative work. This year saw some sophisticated phishing attacks, and virus writers have been branching into relatively new areas like instant messaging and social networking sites, noted Christopher Boyd, security research manager for FaceTime Communications. But the trend overall, he said, has been "quantity over quality." Kaspersky Lab in Moscow is on the front lines of the battle. Its analysts added 2,000 signatures to their database in January 2005. Last month they added 10,000 signatures -- a five-fold increase, said Stanislav Shevchenko, head of the lab. The virus analysts work 12-hours shifts, pulling up screen after screen of rolling lines of code. Automated tools analyze some pieces of malware, but human analysis is still needed for others. A good analyst should process an average piece of malware within 5 minutes, Shevchenko said. But some of the rarer, more creative code is harder to crack. Polymorphic viruses -- ones that can change their byte sequences to throw off antivirus software -- can take up to a week to analyze, Shevchenko said. The signatures are added to a database used by Kaspersky's antivirus engine, which is licensed by other security vendors such as Juniper Networks, ClearSwift , and F-Secure. The increase in the volume of malicious code can be attributed in part to the impunity enjoyed by malware writers, said Eugene Kaspersky, head of antivirus research. Despite efforts by law enforcement agencies to strengthen international cooperation, most malware writers are never punished. "It's quite safe for them," Kaspersky said. "If they are clever enough, there is almost no risk for them at the moment." The U.S. Federal Bureau of Investigation and Russia's Federal Security Service (FSB), the successor to the country's KGB intelligence agency, frequently ask Kaspersky Lab for information, said Kaspersky spokesman Timur Tsoriev. The FSB, however, approaches Kaspersky less these days since the agency has bolstered its in-house expertise, Kaspersky said. Kaspersky said his lab focuses less on finding the root of criminal activity than protecting the company's customers. But the burden of rising online criminal activity directly impacts security companies, he said. "If there is no help from the police and if they don't reduce the number of criminals, I'm afraid the detection for all antivirus products will go down," Kaspersky said.
385607
Spooky project plots zero day defences A project aimed at developing defences against malware that attacks unpatched vulnerabilities involved tests on samples developed by the NSA.â¦
57973
A massive hack of several hundred legitimate Web sites is spreading malware to visitors' PCs using a new tack that makes detection "extraordinarily difficult,"  security experts said today.
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
711347
Code that exploits a "critical" Windows flaw has been posted on the Net, opening the door for a worm to be created.
564338
A rootkit based on proof-of-concept code presented at 2005's Black Hat conference is currently infecting thousands of Windows-based PCs, and researchers say it's a remarkably sophisticated -- and hard-to-eradicate -- infection.