BlackHole receives upgrade to ensure attacks persist
The authors of the BlackHole exploit toolkit have updated their creation to include new functionality that will automatically redirect users from a compromised website to one that serves the malware, according to researchers at Symantec.
The problem for BlackHole's creators has been when users visit a hacked website containing a JavaScript-enabled IFRAME that doesn't link to any malware.
"If the location or URL for the IFRAME, which actually contains the malicious code, changes or is taken down, all of the compromised sites will have to be updated to point to this new location," Nick Johnston, a senior software engineer, wrote in a Symantec blog post that was updated Thursday. "This process is difficult and impractical." That's where a new capability known as "pseudo-random domains" comes into play. The JavaScript code contained on the initial site that victims visit, typically in a drive-by download scenario, is programmed to create and point to other URLs based on certain factors.
