Computer Security Symposium 201521 - 23 October 2015

Exploit Kit

135-8671
33-9{mashikoh,ootanihs,shigetam}@nttdata.co.jp

Exploit Kit

Drive-by Download

Exploit Kit
Exploit Kit
MWS2015

Improving Cyber Attack Detection System To Adopt
The Changing Of Exploit Kit
Hiroki Mashiko

Hisamichi Ohtani

Masayoshi Shigeta

NTT DATA Corporation.
Toyosu 3-3-9, Koto-ku, Tokyo 135-8671, JAPAN{mashikoh,ootanihs,shigetam}@nttdata.co.jp
Abstract We have developed the cyber attack detection system, which is monitoringlogs of network appliances. The system captures characteristics of Exploit Kits, and has
advantages in detection of Drive-by Download Attack. Therefore, if the characteristics ofExploit Kits are changing, the system needs updating. So, not only we have improved thesystem to catch up the changing of Exploit Kits, but also we implemented a new method
which capture another characteristics of Drive-by Download Attack. In this paper, we
describe the detection rate of this system by using MWS2015 Datasets, and discuss
about the advantages of a new method which we implemented to improve the system.
Exploit Kit
Drive-by Download

1DbD
2014

－ 24 －Exploit Kit

pre-DL
Exploit Kit
Exploit Kit

Exploitmalware-DLExpolit2

pre-DL

2.1

malware-DL
[1]

DbD

1Exploit Kit
5Nuclear Exploit Kit

DbD
11 DbD
1 Exploit Kit

DbD

Redirectpre-Exploit
pre-Exploit

1(2)

(1)
Redirect(3)(4)
Exploitpre-DL(3)pre-Exploit

Exploit(5)pre-DL
h**j.c**r.pwsuffix

pre-Exploit
Exploit

UserAgent

Exploitpre-Exploit
(5)

2

2 DbD

pre-DL
Downloader

Downloader－ 25 －2 (3)HTMLiframe
WebInternet Explorersuffix html

Javascript
HTML
UserAgentHTMLJavascript

JREExploit
Exploit Kit

Java(4)
CVE-2013-2423
Exploit
JRE
Web
JRE

JRE
(4) JREExploit
(3)

JRE

2014

Exploit Kit

UserAgentsuffixjar

2.3

Exploit(5)
Windows(5)
Zbot

JRE
UserAgent

Exploit Kit

Exploit Kit
Exploit Kit
2014
JRE

JRE

Adobe Flash Player
JRE

JRE
JRE
suffixUserAgent

Exploit Kit
Exploit Kit

Nuclear Exploit Kit
JavaExploit Kit

6
pre-Exploit
pre-DL
Exploit Kit

DbD

3
3.1
2.1

2.2

Exploit Kit
pre-Exploit

Tokyo SOC

[2][3]
DbD

2013
JRE

90%
2014
DbD
65%
Adobe Flash Player
DbD
2013
10%
2014
34%Cisco 2014 Midyear Security Report[4]
FlashPack Angler, Fiesta, RIG－ 26 －

pre-DL3
malware-DLKit
2Exploit Kit

2014

89RedirectExploit

DbD
DbD

(5)
69

Redirect

URLRIGExploit Kit

malware-DL
Exploit Kit

Redirect

3.2

Redirect

Redirect

DbD
pre-Exploit

WindigoRedirect847
Exploit Kit
Redirect[5]B)
2014

r**k.ru
91542A)
2014

8TrendMicro
4 RIG

FlashPack Exploit Kit
[6]
DbD
URL
24(2)
Redirect(3)
pre-Exploit / Exploit(3)
RIG Exploit Kit
Redirectr**k.ru
DbD
952 FlashPack2(3) (4)Redirect(5)pre-Exploit / Exploit(5)
FlashPack Exploit Kit
5 NullHole

2014

95(2)
Redirectpre-Exploit /Exploit
RedirectURL(3)
NullHole Exploit Kit

3

Redirect

3 RIG

3(3) (4)20148Redirectpre-Exploit
DbD

2Exploit Kit－ 27 －(3)4pre-Exploit

pre-DL

Redirect
Redirect

URLExploit Kit
43.3

malware-DL
4malware-DL
4
Kit malware-DL

Exploitmalware-DL(3) {base64}
URL

Web
Web

DbD
URL

Redirect
Web

Redirectpre-DLWeb

malware-DL
Downloader

Redirect
Web

DbD

Web

malware-DL

4
4.1

Redirect

Redirect
5
Redirect
1 2

ProxyWeb

DbD
DbD
DbD(i)302DbD
DbD(ii) Movable Type
URL(iii)

DbD
FlashDbD(iv) Wordpress
Internet Explorer－ 28 －DbD

DbD
(A)

(v)

pcap
DbD

pcap
HTTP

4.2

ProxyExploit(A)

RedirectExploit Kit
pre-Exploit

pre-Exploit, Exploit, pre-DL
pre-DL
Exploit

Proxy283

Exploit Kit

5.2

DbD

3
JRE
73Exploit

Exploit Kit(a)RIG, Fiesta, Angler, FlashPack2011
2013
2013
2014

(b)
Nuclear, Neutrino, Magnitude

5 D3M Datasets

55.2%
80%
95.2%
2015

2012

1
D3M

5.1
D3M(Drive-by DownloadMarionette) Datasets 2015

Data2

byDatasets 2014[7]2015Angler Exploit Kit

A) Web(Marionette)
DbDB) Marionette

URL
Angler Exploit Kit

URL

Proxy(Botnet Watcher)
C&C

pcap
2－ 29 －3Exploit

0byte6.2byteRedirect24

Exploit
180%Exploit

Exploit
65Exploit
Internet Explorer
DbDExploit
6
Redirect65

D3M Datasets

Exploit6

Redirect
ExploitRedirect

6.1
2015

47

730

Redirect2015 6 1
5 4,915
10

Redirect6

Redirect30
Proxy0.018%

1
Redirect

0.011%[7]

8

Redirect
Exploit
ExploitRedirect

Redirect

ExploitRedirect

Exploit
Exploit－ 30 －Exploit[1],Drive-by Download

JRE,,, MWS

9Exploit Kit
ExploitRedirect

Redirect
Exploit
ExploitRedirect2013[2]2013
TokyoSoc,
https://www-935.ibm.com/services/multime
dia/tokyo-soc-report2013-h2-jp.pdf[3]2014
TokyoSoc,
https://www-304.ibm.com/connections/blog
s/tokyo-soc/resource/PDF/tokyo_soc_report
2014_h1.pdf[4]Cisco 2014 Midyear Security Report,
http://www.cisco.com/web/offers/lp/midyear-security-report/index.html[5]Olivier Bilodeau, Operation Windigo,
http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf[6]Walter Liu, “Website Add-on Targets
Japanese Users, Leads To Exploit Kit”,
http://blog.trendmicro.com/trendlabs-securi
ty-intelligence/website-add-on-targets-japa
nese-users-leads-to-exploit-kit/[7],,,

Redirect,
JRE

MWS2014
Exploitmalware-DL

malware-DL
Downloader
Exploit Kit
Downloader
C&C－ 31 －