Hackers update malware tool kit, add first zero-day attack code

A new version of the IcePack hacker exploit tool kit has been released, security researchers warned today, and for the first time it includes attack code designed to exploit an unpatched, or zero-day, Microsoft vulnerability.

Three of IcePack’s eight exploit tools are new, said Roger Thompson, chief technology officer at Exploit Prevention Labs Inc. That’s noteworthy in and of itself, Thompson said. “The mix of old and new exploits is to be expected, but three new ones in one update is pretty impressive,” he noted.

But the new tool kit also sports a first. “The latest iteration has done something original,” said Thompson, pointing to an exploit that attacks a zero-day vulnerability in Microsoft’s DirectX software development kit (SDK). “The closest to a tool-kit zero-day exploit [before] was for the ANI [animated cursor] vulnerability.”

He was referring to a Windows bug that surfaced in early April. By the time that Mpack, an IcePack predecessor, added the ANI exploit, however, Microsoft had patched the vulnerability with an emergency out-of-cycle update.

The DirectX SDK bug was disclosed by Polish researcher Krystian Kloskowski in a post to the milw0rm.com site in mid-August. Microsoft did not release a fix for the flaw in the regularly-scheduled updates issued earlier today.

IcePack is only one of several click-to-attack malware tool kits in circulation. Derived from the earlier Mpack, IcePack joins others boasting monikers like NeoSploit and WebAttacker that cater to what Thompson called “lazy crooks.”

“Originally there was just WebAttacker, but they screwed up and then NeoSploit came along,” Thompson said as he rattled off the exploit tool kit genealogy. “Then there was Mpack, which everyone at first thought was just WebAttacker, but it wasn’t. Now there’s IcePack.” He estimated that nine to 12 malware tool kits are currently in use.

“They all use very similar code, and they’re all trying to make a buck out of selling to lazy crooks,” said Thompson.

Even though the just-updated IcePack features the first zero-day attack code seen in a malware kit, Thompson downplayed the threat. Sort of. “This is not an end-of-the-world kind of thing, since not many people will have the [DirectX] SDK. But no one knows what other software packages use that [vulnerable] ActiveX control. It’s a little like Russian roulette that way.”

Other researchers confirmed Thompson’s assessment. Symantec Corp., for instance, warned customers of its DeepSight threat network that it had spotted in-the-wild attacks using the DirectX exploit. Symantec’s researchers also confirmed that the other two exploits new to IcePack target vulnerabilities in Yahoo Messenger and Yahoo Widgets. Both of those bugs, however, have been patched.

Taking aim at patched vulnerabilities is a common characteristic of multistrike kits, even though it might seem counterintuitive, said Thompson. “They usually go after lesser-known vulnerabilities,” he said. “They just want to shake a few apples from the tree, enough to make money. They don’t want to bring down the whole branch.”