Hacker 'Smartbomb' toolkit attacks unpatched computers

By Gregg Keizer, TechWeb 26 April 2006 0*:*8 AEST Security

A dirt-cheap, do-it-yourself hacking kit sold by a Russian website is being used by more than *,000 malicious websites, a security company said on Monday.

Those sites have confiscated hundreds of thousands of computers using the "smartbomb" kit, which sniffs for seven unpatched vulnerabilities in Internet Explorer and Firefox, then attacks the easiest-to-exploit weakness.

For US$*5 to US$20, hackers can buy the "Web Attacker Toolkit," said San Diego-based Websense in an online alert. The tool, which uses a point-and-click interface, can be planted on malicious sites - or on previously-compromised computers - to ambush unsuspecting users.

"It puts a bunch of code on a site that not only detects what browser the victim is running, but then selects one of seven different vulnerabilities to exploit, depending on how well patched the browser is," said Dan Hubbard, senior director of security and research at Websense.

Both Firefox and Internet Explorer vulnerabilities are among the seven.

Websense has detected the kit being used about *,000 sites, which then plant a Trojan horse on vulnerable computers. The Trojan is installed in a silent "drive-by download" that doesn't require any user intervention; in fact, it installs in the background, so the user has no idea her computer has been hacked.

The Trojan can log keystrokes, download additional code, or open backdoors, said Websense.

"What's interesting is that these sites all have an administration console on them with statistics. We've managed to capture a couple of screenshots."

Those screens, posted with Websense's advisory, detail the browsers running on the compromised computers and keep a running tally of the most successful vulnerabilities.

According to the screenshots, the single site that Websense illustrated had attracted 5*,8*6 computers, the bulk of them - 76 percent, in fact - running Microsoft Internet Explorer. (About *2 percent ran Firefox; the remainder were unspecified.)

This site, however, only used 4 of the 7 vulnerabilities, all of them directed at IE. The most successful of the quartet as one tagged as MS0*-** to match the security bulletin MS0*-0**, which published a patch for a bug in Microsoft Virtual Machine in April 200*. The malicious site managed to compromise *,77* PCs using that three-year-old flaw, a *.42 percent infection rate.

"And this is just one site," Hubbard said. "Together, these sites have compromised tens if not hundreds of thousands of systems."

The next-most useful vulnerability was dubbed "0-day" (zero-day), but was actually the "createTextRange" bug that was discovered last month and patched April ** by Microsoft, said Hubbard. That vulnerability was used to compromise *,507 PCs (2.* percent success rate).

"Everyone knows they should patch their browsers," said Hubbard, "but this is further evidence that that's not happening as much as it should be."

The trend toward hackers sharing attack code, even selling simpleton software "kits," has been well-documented. Just last week, in fact, McAfee's research labs reported a major increase in the use of rootkits to cloak worms, Trojans, and spyware; the boost is largely due to cut-and-paste-style tools that automatically add rootkit components to other malicious code, Stuart McClure, chief of McAfee's research lab, said in an interview last week.

"The use of multiple vulnerabilities isn't commonplace," added Websense's Hubbard. "But this toolkit shows how hackers are becoming more and more organised."