Hackers resurrect notorious attack tool kit
Neosploit, thought dead three months ago, behind PDF attacks, researcher says
September 25, 2008 12:00 PM ETComputerworld - Neosploit, the notorious hacker exploit kit that some thought had been retired months ago, has not only returned from the dead, but is responsible for a dramatic increase in attacks, a security researcher claimed today.
"Neosploit's back," said Ian Amit, director of security research at Aladdin Knowledge Systems Inc.
The accounts of its demise last summer had been a ruse, he argued. "When you're feeling that kind of heat," Amit said, referring to the attention Neosploit had received from both researchers and authorities, "you want to shake those guys off your back. [The talk about quitting] only helped them go under the radar."
In July, researchers at RSA's FraudAction Research Lab said that they had evidence that the creators of Neosploit were abandoning the business. For proof, RSA quoted a going-out-of-business message said to have originated with Neosploit's authors.
Neosploit, which first appeared in 2007, was a follow-on to the earlier MPack and a contemporary to another infamous exploit kit, WebAttacker. Those kits, including Neosploit, were used by cybercriminals to launch attack code aimed at new vulnerabilities in Windows, Internet Explorer or third-party software such as Apple Inc.'s QuickTime. But Neosploit also boasted features new to the click-to-attack business, including sophisticated statistical analysis and management tools.
However, even RSA didn't expect the Neosploit group to disband. "This isn't necessarily the end of this group," said Sean Brady, an RSA product marketing manager, in July.
Turns out he was right.
A month ago, researchers at Aladdin started to suspect that the Neosploit developers were back in business. Two days ago, they uncovered hard evidence: A server hosted in Argentina, run by a longtime Neosploit customer, that contained Neosploit 3.1. The build was dated Aug. 9, weeks after Neosploit's makers supposedly threw in the towel.
According to Amit, other data on the server showed that it was catering to 20 users, seven of whom he characterized as "very high volume," who were logging thousands of successful exploits every day from their use of Neosploit.
Those 20 criminals, added Amit, had compromised between 200 and 300 Web sites, which in turn were being used to serve up exploits from Neosploit to any visitor running a system that had not been fully patched. He found evidence of more than a quarter-million successful attacks against PCs carried out by those sites.
"Neosploit's sole purpose is to deliver malicious code to browsers," Amit said, noting that site hacking isn't part of the kit's jobs. Instead, criminals compromise sites through other vulnerabilities or by gaming the site's administrative password. Only then do they modify the hacked site with attack code from Neosploit.
Neosploit
Additional Resources



White Papers & Webcasts
Share our Strength
Download Now
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Top 10 Things to Know about Data Protection
Download Now
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Ponemon Study: The Business Risk of a Lost Laptop
Download Now
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Airport Insecurity: The Case of Lost Laptops
Download Now
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
