What are browser exploit kits up to? A look into Sweet Orange and ProPack

Today’s BEPs provide automated iframe obfuscating services for use in web injections. The iframes are injected into high-traffic-volume websites and force the users of the websites to visit end points that serve exploits carrying malware. The SO BEP framework includes an iframe cryptor service for obfuscating iframes. This extends the capability of SO to obfuscate and inject the iframe at the same time, meaning that the attacker does not have to buy obfuscation services from a third-party provider. (Basically, it is a crimeware service embedded in the automated exploitation framework.) It also enables the owners of SO to charge more per licence.

We analysed this functionality in SO to understand exactly how the iframe obfuscation patterns are generated. This is important because an understanding of iframe obfuscation will help analysts to dissect the attacks more easily. We simply used the payload ‘<script>alert(1);</script>’ and obfuscated it using the SO iframe cryptor service. Figure 1 shows the output of this service.

Figure 1. The Sweet Orange iframe cryptor in action.

The generated obfuscated code adds some ‘%’ characters into a given JavaScript call and declares it as a value to A12836177. Later on, a JavaScript replace call is used to change all the ‘%’ characters to null (‘’). An additional function is generated, called gd. Then, the code is mixed up with random JavaScript calls to increase its complexity. This is a simple example of how SO builds the obfuscated iframes inside the framework.

SO implements a centralized domain management system. It makes extensive use of domain management APIs for easy operational and functional tasks. The BEP has a built‑in domain-scanning engine (Scan4You) which provides information about the state of running and blacklisted domains – it scans the websites that are injected with malicious iframes.

The user can configure the domain-scanning service with username, password and API token. This information is entered in the SO panel (see Figure 2) and once it has been provided a scheduler service is set up that runs scans after a couple of minutes. This process is deployed for active domain verification so that the attacker can perform alter operations if a domain is flagged.

Figure 2. Anonymous service – Scan4You.

Scan4You [4] is an anonymous service that scans malware against multiple anti-malware products and checks domains against a number of domain blacklists – and crucially, does not report the results back to the anti-malware/blacklist developers. The service is updated periodically to include newer versions of anti-virus software and blacklists. It can thus determine whether the domain hosting SO has been blacklisted or not, and which anti‑virus engines can detect the malicious binary. Table 1 shows the list of anti‑virus engines and blacklists supported by the service.

As a security measure, the domain scanning function can easily be disabled (see Figure 3). This disrupts the flow of outgoing traffic from the domain hosting the SO panel and allows it to generate a new link (URL) if the previous one has been marked as malicious. No traffic that points to the old link is accepted, and such traffic is discarded by the server running SO.

Figure 3. Sweet Orange domain security check.

The domain management API is implemented using the HTTP protocol, which provides easy control over the network simply by sending HTTP requests to fetch the data. Table 2 shows the primary API calls used to gather data from the infected domains.

Based on the information presented in Table 2, an IDS signature can be crafted using the primary command which generates heavy traffic.

Almost all BEPs implement a Traffic Distribution System (TDS) to control incoming Internet traffic based on several characteristics. The SO TDS has the following properties:

Figure 4 shows that the maximum traffic limit implemented in SO is 150,000 unique hits.

Figure 4. Traffic limit in SO.

During our analysis, we have noticed a few improvements in SO’s request processing mechanism to make the exploitation process faster. This is done to achieve high performance and optimization.

The ProPack BEP implements a buffer-based technique to manage incoming connections. The buffer holds information about the victim’s machine including what plug‑ins are present, the OS version, IP address, etc. When connection attempts are received from target machines, the exploit‑serving component initiates a buffer which is used to queue the requests. In other words, ProPack executes batch processing in which all the connection attempts are treated as jobs that are required to be completed without manual intervention. This means that all the specific data is selected earlier and pushed into the exploit-serving component depending on the information extracted from the user’s machine. In addition to this, the threading is done efficiently. With proper threading and batch processing, multiple requests can be served at the same time and every thread is shipped with a different executable that is obfuscated differently. This approach also helps to deploy server‑side polymorphism, in which executable files are generated randomly with different signatures.

ProPack uses the Sypex geo-location library to fingerprint the origin of requests by analysing the IP address of the client. Blackhole uses the MaxMind geo library for processing traffic information based on the IP address. Newer exploit packs are shifting away from using MaxMind to using Sypex because of advantages of the latter such as high speed and low memory consumption. Sypex can easily be integrated with a batch processing routine by implementing caching in memory which increases speed significantly. As Sypex is written in PHP, it can easily be plugged in with the BEP components. Sypex uses binary mode to implement storage structures, avoiding JSON and XML, which consume a lot of processing time. In binary mode, the storage data can easily be differentiated by placing null characters at the end. In order to search for information about IP addresses in the database files, Sypex reads a definite chunk of data from the hard disk, thereby avoiding random searching. For this, Sypex implements a search index using the first byte of the IP address. The idea is to traverse less data to find the requisite information and increase the speed. Following our analysis of ProPack traffic, Listing 1 shows possible network signatures that can be used to detect the ProPack exploit kit.

alert tcp $HOME_NET 1024: -> $EXTERNAL_NET $HTTP_PORTS (msg:”Propack Exploit Detection”; flow:established,from_client; 
flowbits:set,Propack; 
flowbits:noalert; 
content:”GET”; 
http_method; 
content:”.php?j=1”;
 http_uri; 
content:”|26|k=”; 
within:3; 
content:” HTTP/1.1|0d 0a|”; 
within:15; 
content:!”|0d 0a|Cookie|3a| “; 
http_header; 
pcre:”/\.php\?j=1&k=[12345]/U”; 
reference:url,[ ];  classtype:Exploit; sid:XXXXXXXXX; rev:1; )

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET 1024: (msg:”Propack Malware Binary Successfully Loaded “; 
flow:established,from_server; 
flowbits:isset,Propack; 
content:”Content-Disposition: attachment|3b| filename=”; 
offset:50; 
depth:400; 
content:”MZ”; 
distance:0; 
content: “PE|00 00|”;
 within:250;  
reference:url,[ ]; classtype:Exploit; sid:XXXXXXXXX; rev:1; )

Listing 1: ProPack detection signatures.