The Emergence of Exploit-As-A-Service

Manufacturing Compromise: The Emergence of Exploit-as-a-Service Chris Grier† Lucas Ballard2 Juan Caballerox Neha Chachra∗ Christian J. Dietrichq Kirill Levchenko∗ Panayiotis Mavrommatis2 Damon McCoyz Antonio Nappax Andreas Pitsillidis∗ Niels Provos2 M. Zubair Rafiquex Moheeb Abu Rajab2 Christian Rossowq Kurt Thomasy Vern Paxson† Stefan Savage∗ Geoffrey M. Voelker∗ y University of California, Berkeley ∗ University of California, San Diego 2 Google International Computer Science Institute x IMDEA Software Institute q University of Applied Sciences Gelsenkirchen z George Mason University ABSTRACT 1. INTRODUCTION We investigate the emergence of the exploit-as-a-service model for In this work we investigate the emergence of a new paradigm: the driveby browser compromise. In this regime, attackers pay for an exploit-as-a-service economy that surrounds browser compromise. exploit kit or service to do the “dirty work” of exploiting a vic- This model follows in the footsteps of a dramatic evolution in the tim’s browser, decoupling the complexities of browser and plugin world of for-profit malware over the last five years, where host com- vulnerabilities from the challenges of generating traffic to a web- promise is now decoupled from host monetization. Specifically, the site under the attacker’s control. Upon a successful exploit, these means by which a host initially falls under an attacker’s control are kits load and execute a binary provided by the attacker, effectively now independent of the means by which an(other) attacker abuses transferring control of a victim’s machine to the attacker. the host in order to realize a profit. This shift in behavior is exem- In order to understand the impact of the exploit-as-a-service plified by the pay-per-install model of malware distribution, where paradigm on the malware ecosystem, we perform a detailed anal- miscreants pay for compromised hosts via the underground econ- ysis of the prevalence of exploit kits, the families of malware in- omy [4, 41]. Where the pay-per-install market relies on a mixture stalled upon a successful exploit, and the volume of traffic that ma- of social engineering, spam, and other infection vectors to com- licious web sites receive. To carry out this study, we analyze 77,000 promise hosts, the exploit-as-a-service model specifically relies on malicious URLs received from Google Safe Browsing, along with driveby downloads. a crowd-sourced feed of blacklisted URLs known to direct to ex- Our prior work suggests that driveby downloads that target ploit kits. These URLs led to over 10,000 distinct binaries, which browser and plugin vulnerabilities (e.g., PDF viewers, Flash, and we ran in a contained environment. Java) to install malware now represent the largest threat to end Our results show that many of the most prominent families of users [30]. The vanguard of this assault is lead by the development malware now propagate through driveby downloads—32 families of exploit kits: packages of browser exploits that simplify the act in all. Their activities are supported by a handful of exploit kits, of compromising victims that visit malicious websites. While web with Blackhole accounting for 29% of all malicious URLs in our exploit kits themselves are not new, dating back to at least MPack data, followed in popularity by Incognito. We use DNS traffic from in 2006 [34], there is little doubt that exploit kits have come of real networks to provide a unique perspective on the popularity of age. The recent compromise of mysql.com—a site in the Alexa malware families based on the frequency that their binaries are in- 1000—was used to infect visitors using the Blackhole exploit ser- stalled by drivebys, as well as the lifetime and popularity of do- vice [14], which we have found anecdotally (via Blackhole man- mains funneling users to exploits. agement screenshots) to achieve a successful compromise rate of 9–14% [17, 43, 46] Categories and Subject Descriptors In order to understand the impact of the exploit-as-a-service mar- K.4.1 [Public Policy Issues]: ABUSE AND CRIME INVOLVING ketplace on the malware ecosystem, we perform a detailed analysis COMPUTERS of the prevalence of exploit kits, the families of malware installed Keywords upon a successful exploit, and the volume of traffic malicious websites receive. To carry out this study, we aggregate and analyze Security, Malware 77,000 malicious URLs received from Google Safe Browsing, and from a crowd-sourced feed of blacklisted URLs known to direct to exploit kits. For each of these URLs, we also obtain at regular Permission to make digital or hard copies of all or part of this work for intervals a copy of the malicious binaries they attempt to install, to- personal or classroom use is granted without fee provided that copies are taling over 10,000 variants from the course of March 1, 2012 until not made or distributed for profit or commercial advantage and that copies April 20, 2012. bear this notice and the full citation on the first page. To copy otherwise, to We run each of these binaries in a contained execution environ- republish, to post on servers or to redistribute to lists, requires prior specific ment and determine a sample’s family as well as its monetization permission and/or a fee. approach, such as spam, fake anti-virus, and a multitude of other CCS’12, October 16–18, 2012, Raleigh, North Carolina, USA. Copyright 2012 ACM 978-1-4503-1651-4/12/10 ...$15.00. strategies for profiting off of an infection. To offer a comparison to 821 other competing malware distribution techniques, we develop and exists, the victim’s machine is compromised and any variety of mal- acquire malware feeds that include malicious email attachments, ware can be installed (¹,º). torrents for pirated software, malicious binaries installed by drop- The challenge of identifying new browser exploits, funneling pers tied to the pay-per-install marketplace, and binaries extracted traffic to malicious webpages, and monetizing compromised hosts from live network traffic. We find that drivebys and droppers are the has led to a diversification of roles within the malware ecosystem, primary source of the most prominent malware families, indicating and in particular, the emergence of a new marketplace surround- a continuing shift in the malware ecosystem towards miscreants ing exploit-as-a-service. This marketplace currently includes two that specialize solely in compromising hosts. business models: exploit kits and Traffic-PPI services. In addition to the malware installed by browser exploits, we ex- In the exploit kit model, miscreants either purchase exploit kits amine the exploit kits that are behind the scene. We determine that (software only) or rent access to pre-configured exploit servers Blackhole accounts for 29% of all malicious URLs, followed in (hardware and exploit software). This business model fulfills all the popularity by Incognito and a small handful of other exploit kits. requirements of step ¸ and º in the driveby chain. Clients are re- Combined, these kits are used to distribute at least 32 different fam- sponsible for luring their own victims and determining which mal- ilies of malware. Furthermore, we map out the complex infection ware to distribute. chain tied to driveby exploits, including the use of compromised Traffic-PPI service take the exploit pack model one step further pages and the redirection of victims to multiple exploit kits simul- and can be considered an evolution of the pay-per-install service taneously. model [4]. In this model, clients simply purchase installs and pro- Finally, using 3.5TB of passive DNS data collected from several vide their binaries (¹), while the Traffic-PPI service takes care of large ISPs and enterprises, we provide a unique perspective on the the entire process of generating traffic, redirecting, and exploiting ranking of malware families based on the frequency that drivebys a victim’s browsers (¶, ·, ¸) until finally installing the client’s install their binaries as well as the lifetime of exploit domains. We software (º). find that droppers, information stealers, and fake anti-virus software dominate the monetization of drivebys. Despite finding that 2.1 Exploit Kits and Servers exploit domains survive for a median of only 2.5 hours, we show For our purposes we will use the term exploit kits (or packs) to that thousands of visitors suffer exposure to drivebys due to the refer to software packages that bundle multiple exploits targeted at compromise of popular webpages. Lastly, we examine the impact vulnerabilities in web browsers and their plugins (e.g., Flash, PDF of Google Safe Browsing on driveby domains. While our analysis and Java). Popular exploit kits include Blackhole, Eleonore, and clearly highlights that websites hosting driveby exploits encounter Phoenix [9]. Attackers install exploit kits on web servers, and we immense pressure, this does not suffice to disrupt operations com- term the combination of server plus exploit kit as an exploit server. pletely. Upon a visit to a domain hosted in an exploit server, the exploit In summary, we frame our contributions as follows: kit automatically profiles the browser and delivers an exploit based on the operating system, browser, and plugin configuration. If the v For each driveby site, we identify the most popular exploit succeeds, it downloads a binary that then executes on the exploit kit used and the malware family served by user’s computer. the site, including its monetization scheme. Exploit kits date back at least to MPack from 2006 [34]. The tra- v Using passive DNS data we estimate the rela- ditional business model for commercializing exploit kits has been tive popularity of malware families distributed via one-time fees [27]. Like traditional software, once purchased, such driveby exploits.

Load more