Paper Info
Title
Pexy: The Other Side Of Exploit Kits
Abstract
The drive-by download scene has changed dramatically in the last few years. What was a disorganized ad-hoc generation of malicious pages by individuals has evolved into sophisticated, easily extensible frameworks that incorporate multiple exploits at the same time and are highly configurable. We are now dealing with exploit kits.In this paper we focus on the server-side part of drive-by downloads by automatically analyzing the source code of multiple exploit kits. We discover through static analysis what checks exploit-kit authors perform on the server to decide which exploit is served to which client and we automatically generate the configurations to extract all possible exploits from every exploit kit. We also examine the source code of exploit kits and look for interesting coding practices, their detection mitigation techniques, the similarities between them and the rise of Exploit-as-a-Service through a highly customizable design. Our results indicate that even with a perfect drive-by download analyzer it is not trivial to trigger the expected behavior from an exploit kit so that it is classified appropriately as malicious.
Year
DOI
Venue
2014
10.1007/978-3-319-08509-8_8
DETECTION OF INTRUSIONS AND MALWARE, AND VULNERABILITY ASSESSMENT, DIMVA 2014
Field
DocType
Volume
World Wide Web,Control flow graph,Computer science,Download,Exploit,Taint checking,User agent,Extensibility,Operating system
Conference
8550
ISSN
Citations 
PageRank 
0302-9743
7
0.46
References 
Authors
12
5
Name
Order
Citations
PageRank
Giancarlo De Maio170.46
Alexandros Kapravelos232420.58
Yan Shoshitaishvili335826.98
Christopher Kruegel48799516.05
Giovanni Vigna57121507.72