Freebie Black Hole Exploit Kit Limited By Encoding

Obfuscated and encoded code prevents easy customization and creation of new versions

A free download of the Black Hole crimeware exploit kit is now available to anyone, but its locked down such that users cant customize or build new versions of it.
Black Hole is a Web exploit kit believed to be developed by Russian hackers; it is typically used for drive-by download attacks using Java and Adobe PDF exploits, among others. It has become one of the most widely deployed exploit kits and is relatively pricey, with a $1,500 annual license fee. Its creator also offers shorter-term licenses: $35 for one day, $700 for three months, and $1,000 for six months.
But the freebie Black Hole version circulating online isnt as feature-rich as the paid version. The download link contains obfuscated and encoded PHP code, says HD Moore, CSO of Rapid7 and chief architect of Metasploit. That means unlike the recent release of the unencoded Zeus source code, anyone who uses the Black Hole free download cant build new versions of it, he says.
The software also includes a large DAT file that houses copies of stolen passwords and other sensitive data, Moore says. It appears to be a snapshot of an installed Black Hole kit from a server, he says.
And Moore says it likely was not the Black Hole creator who released the kit. Someone pirated someone elses software and released it, Moore says. You cant change and modify it [when] its encoded ... Decoding it is a big project. Youd have to decode every [piece of] PHP code, file by file. Its so far removed from standard reverse-engineering ... that its just not that useful.
So the freebie Black Hole crimeware kit is fairly limited, although a user could salvage the exploits it contains: The exploits themselves are useful, Moore says. You could grab copies of the exploit and build out your own exploits. But that wont buy you much because the AV engines [already] have it.
Another possibility is that the Black Hole author himself leaked the kit, says Alen Puzic, security researcher at HP DVLabs, and is offering that limited version of the kit as a marketing ploy, of sorts. This is a tactic used quite often: They leak their own copy that doesnt have all of the features the newest copy has, Puzic says. So if users end up liking the leaked copy, they might want to buy the full copy. I suspect that might have happened.
Puzic says Zeus author used that strategy. Whenever there was a new copy of Zeus [malware kit], the old copy was leaked for free, he says. That really worked for them.
The bottom line is that with yet another free crimeware kit out there, cybercrime is bound to benefit. Well see more cybercrime as a result of this, for sure, Puzic says. Ill be interested to see what happens next ... But I think this [free tool] is very dangerous.
And Aviv Raff, CTO of Seculert, says having this and Zeus available for free will make them available to bottom feeders of the cybercrime ecosystem. Having both malware and exploit kits available freely for anyone to download and use will allow even the bottom feeders of the cybercrime ecosystem to start using those dangerous weapons together. If malware kits -- like Zeus -- are like the weapon, the exploit kits -- like Black Hole -- are the ammo, Raff says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Freebie Black Hole Exploit Kit Limited By Encoding