Anatomy of Exploit Kits

Sameer Patil

(sameerpatilmsgmailcom)

SecurityXploded

Exploit Kit Introduction

Phases

Exploits used

Access Filters

Detection

Analysis of exploits

Content

Fiesta

FlashPack

Magnitude

Nuclear

Angler

Sweet Orange

Neutrino

Exploit Kits

Exploit Kit Naming

Compromised site

Redirector

Landing page

Post-infection traffic

Phases

LFI in RevSlider plugin of Wordpress

http[compromisedcom]wp-adminadmin-ajaxphpaction=revslider_show_imageampimg=wp-configphp

XSS in Simple Security Wordpress plugin CVE-2014-9570 http[compromisedcom]wp-

adminusersphppage=access_logampdatefilter=27223E3Cscript3Ealert28HACKED293Cscript3E

Drupal Sql Injection

CDN reference compromise (Eg Operation Poisoned Helmand)

Iframe Injectors

Compromised sites

wwwsoyentrepreneurcomassetsjsfuncionesCargajs

Compromised sites

wwwmediaorpicomjsscriptsjs

Redirector (Obfuscated)

It checks if Silverlight plugin is installed by creating the

following ActiveXObject object

ActiveXObject(AgControlAgControl)

The presence of Flash plugin is ensured by creating the following object

swfobjectembedSWF()

Antivirus detectionif( chavs(kl1sys) || chavs(tmciescsys) || chavs(tmtdisys) || chavs(tmactmonsys) || chavs(TMEBC32sys) || chavs(tmeextsys) ||chavs(tmconnsys) || chavs(tmevtmgrsys) ) exit()

Redirector (after deobfuscating)

Download from httpjxlpaianlarin malicious files

Landing Page

Banking Frauds

Spying

Information Stealing

Click Fraud activities

Post-Infection

IE- CVE-2014-0322(zero day) CVE-2014-0324(zero day) CVE-2014-6332 CVE-2013-2551 CVE-2013-3918 CVE-2013-7331

Java- CVE-2013-2460 CVE-2013-2465 CVE-2012-1723 CVE-2012-0507 CVE-2013-0422(zero day)

Flash- CVE-2014-8440 CVE-2014-0556 CVE-2014-0569 CVE-2014-0515 CVE-2014-8439 CVE-2014-0502(zero day) CVE-2015-(zero day)

Silverlight- CVE-2013-0074 CVE-2013-3896

PDF- CVE-2010-0188

Exploits used

Request with no referrer

Block IP addresses

Non-Windows traffic

User Agent access

Plugin-Detect scripts

URL blacklist checks

Access Filters

Obfuscation in JS

Signatures for specific CVEs

User Agent strings

URL patterns

ltdomaingtindexphpreq=mp3ampnum=37ampPHPSSESID=

ltdomaingtindexphpreq=swfampnum=8413ampPHPSSESID=

ltdomaingtindexphpreq=xapampPHPSSESID=

ltdomaingt1phpr

Detection

Java Exploit- CVE-2013-2465

Javascript deobfuscation

Vectorltintgt array of size 0x90 bytes

Vector size resized to 0 resulting in holes between vector objects

Vulnerability exploited

Memory Corruption

Spraying FileReference objects

Modify FileReference object function pointer table

cancel() is called -gt call to VirtualProtect()

Flash Exploit CVE-2014-0515

VectorltIntgt Object Memory Layout

Source HP security Blog

DPBG tool

CVE-2013-2465 Java Exploit

Java obfuscators

PixelBender Exploit

Malware donrsquot need Coffee

Malware Traffic Analysis

References

Thank You

Exploit Kit Introduction

Phases

Exploits used

Access Filters

Detection

Analysis of exploits

Content

Fiesta

FlashPack

Magnitude

Nuclear

Angler

Sweet Orange

Neutrino

Exploit Kits

Exploit Kit Naming

Compromised site

Redirector

Landing page

Phases

Iframe Injectors

Compromised sites

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Fiesta

FlashPack

Magnitude

Nuclear

Angler

Sweet Orange

Neutrino

Exploit Kits

Exploit Kit Naming

Compromised site

Redirector

Landing page

Phases

Iframe Injectors

Compromised sites

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Exploit Kit Naming

Compromised site

Redirector

Landing page

Phases

Iframe Injectors

Compromised sites

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Compromised site

Redirector

Landing page

Phases

Iframe Injectors

Compromised sites

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Iframe Injectors

Compromised sites

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Compromised sites

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

swfobjectembedSWF()

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Landing Page

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Banking Frauds

Spying

Post-Infection

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

PDF- CVE-2010-0188

Exploits used

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Block IP addresses

Non-Windows traffic

User Agent access

Access Filters

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Obfuscation in JS

User Agent strings

URL patterns

ltdomaingt1phpr

Detection

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Memory Corruption

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

DPBG tool

Java obfuscators

PixelBender Exploit

References

Thank You

Java obfuscators

PixelBender Exploit

References

Thank You

Anatomy of Exploit Kits

Technology

Emerging Threats - The State of Cyber Security Live 2015 Melbourne... · Anatomy of an Exploit - Conclusion •Targeted Phishing Campaign using a 0-day –Exploit NOT obfuscated!

The Reign of Ransomware - Trend Micro DE · believe that the Reign of Ransomware will stay prevalent. ... to existing exploit kits even as the number of attacks using the Angler exploit

EPLOT KTS - all-about-security.de€¦ · EPLOT KTS GETTNG N AN EANS NECESSAR. PALO ALTO NETWORKS + EXPLOIT KITS 2 Executive Summary Exploit kits are used to automate the exploitation

Evaluating the Customer Journey of Crypto- Ransomware€¦ · is to include it in the payload of an exploit kit. Users can be exposed to exploit kits when they visit a compromised

The State of Web Exploit Kits - Black Hat Briefingsmedia.blackhat.com/.../BH_US_12_Jones_State_Web_Exploits_Slides.pdf©2011 Hewlett-Packard Development Company, L.P. The information

EKHunter: A Counter-Offensive Toolkit for Exploit Kit ... · 9/3/2017 · Feb 09, 2015, San Diego, CA. EKHunter NDSS'15 2 Exploit Kits malicious toolkits used ... (Microsoft Security

Anatomy of a Remote Kernel Exploit - Security …vulnfactory.org/research/h2hc-remote.pdfConsequence of failed remote kernel exploit: Kernel panic, game over Copyright © 2011 Virtual

Exploit Anatomy

Kizzle: A Signature Compiler for Detecting Exploit Kits · 2018-01-04 · Kizzle: A Signature Compiler for Detecting Exploit Kits Ben Stock CISPA, Saarland University Benjamin Livshits

Cyber-Security - Everyone's Responsibilityprobuswesternottawa.ca/pdf-files/cyber_security.pdfExploit Kits 5 Blackhole, Metasploit, … Java flaws already included in Blackhole exploit

Anatomy of a Remote Kernel Exploit - Dartmouth … of failed remote kernel exploit: Kernel panic, game over Copyright © 2011 Virtual Security Research, LLC. All Rights Reserved. 9

Exploit Kits - Tel Aviv University · PDF file · 2016-06-03Exploit Kits A Weapon Of Mass Infection ©2016 Check Point Software Technologies Ltd. 2 Meet “Paunch ... •Malvertisement

1 - Sophos Ransomware Budapest Apr2016 - TMSI · ￮ Used by Locky, TorrentLocker , CTB-Locker • Exploit kits ￮ Black market tools used to easily create attacks that exploit known

S/S INSTRUMENT KITS - · PDF files/s instrument kits ... probe butterfly probe straight blade pot-bellied blade anatomy forceps surgery forceps klemmer forceps stitch ... dressing

SentinelOne Endpoint Protection Deep Visibility · Exploit kits, malware, adware, callbacks, as well as command & control channels leverage encrypted communications to inﬁltrate

PExy: The other side of Exploit Kits - UCSBvigna/publications/2014_DIMVA...PExy: The other side of Exploit Kits 3 techniques, such as heap spraying, implemented in JavaScript). These

Anatomy of a Remote Kernel Exploit - Lagout.org · Exploit development methodology ... Trapping to kernel mode is relatively expensive Check CPL, switch stack, store trap frame, reload

malwarebytesmalwarebytes.com. Title: exploit-kits-infographic-2 Created Date: 2/25/2016 10:42:54 PM

Anatomy of Exploit Kits - securitylab.disi.unitn.itsecuritylab.disi.unitn.it/lib/exe/fetch.php?media=... · Table of Contents 1 Drive-by-download attacks problem 2 What is drive-by-download

EVOLUTION OF EXPLOIT KITS - Internet- & · PDF fileExploit Kit Attack Scenario ... EVOLUTION OF EXPLOIT KITS Research Paper 4 ... Developers use it to showcase the tenacity of their