The Tech Herald

USPS website hit by Blackhole Exploit Kit

by Steve Ragan - Apr 8 2011, 06:05

Researchers at Zscaler have uncovered a Blackhole Kit attack carried out against the U.S. Postal Service’s Rapid Information Bulletin Board System (RIBBS). This is the second Blackhole Kit attack discovered this week, after another was spotted on the website for the Houston International Film Festival on Monday.

The Blackhole Kit, which was developed in Russia, cost about $1,500 USD annually for anyone who wants to deploy it, with discounts for six-month usage and quarterly usage. Described as being powerful, the kit includes payloads that target vulnerabilities in Java and Adobe PDF. Upgrades to the code make detection harder as the developers add more obfuscation and encryption to the packages.

The USPS attack focused on the RIBBS sub-domain that deals with Intelligent Mail services such as the use of barcodes for better tracking and logistics. Breaking down the attack, Zscaler noted that it followed patterns set previously by the Blackhole Kit by using staging to infect the victim’s machine.

Firstly, the attack starts with an Iframe injected into a legitimate site. This injected code then draws from another domain, which then redirects victims to the third stage. Here, the attack then scans the visitor's system and look for signs of Java or ActiveX before delivering appropriate payloads.

Again, this is the same process used during the attack on the Houston International Film Festival, and in both cases legitimate domains were used to initiate and propagate it each step of the way.

“Yet again, we have a legitimate website with a significant user base being used as a catalyst for attack. Combine that with an abysmal detection rate on the malicious payloads by desktop AV, the first and often only line of client side defense for many enterprises, and we have a potent attack that has no doubt affected many end users,” Zscaler’s Michael Sutton noted.

As this story was posted, the USPS had taken down the RIBBS domain while it works to clean out the infection.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

NBA All-Star LeBron James Teams with Kia

NBA All-Star LeBron James has signed a deal with Kia to be the company’s first luxury ambass...

Classic Car Buying Guide: Hillman Super Minx

What to look for when buying a Classic Car: We use The Hillman Super Minx as an example What...

A Guy Let His Wife Loose With A Sharpie On His Car. What She Did Will Blow Your Mind.

This guy let his wife loose with a sharpie on his Nissan Skyline R33 GTR — and the result is...

2015 Nissan Armada Prices

Nissan has released pricing details for the 2015 Nissan Armada in the US. The 2015 Nissan Ar...

Aquaplaning Danger Highlighted in Video

This UK video highlights the dangers of aquaplaning. When you drive your car over some sitti...