Exploring the Blackhole Exploit Kit by Sophos

[c0dist]

Hi,

I recently came across a pretty explanatory analysis of Blackhole Exploit Kit by Sophos. Sure, the paper is quite old, dating back to March 2012 but nevertheless it serves as a nice start to understand how exploit kits work in general. The paper analyses Blackhole EK version 1.2.2.

Here's link to the paper - http://nakedsecurity.sophos.com/expl...e-exploit-kit/

And here's the table of contents:

1. Introduction
2. Blackhole exploit kit
3. Code obfuscation
4. Tracking Blackhole
5. Discussion and conclusions
6. Appendices

It can be directly downloaded as PDF from -> http://sophosnews.files.wordpress.co...er_mar2012.pdf

Hope this helps.

Regards,
c0dist.

[41.w4r10r]

It would be cool if you can come up with some signature to detect Blackhole exploit kit detection might be through URL pattern.

[c0dist]

Hi 41.w4r10r,

To develop some signature, I would need to observe/analyze a attack that's happening in the wild or either if I can get my hands on source So, as soon as I learn more about Blackhole EK, I'll surely put it on forum.

In the meantime, I found a Yara signature for BlackHole EK V2 from a quick Google search.

http://blog.lab69.com/2012/09/an-eve...ploit-kit.html

Regards,
c0dist.