{"id":15944,"date":"2019-07-30T09:10:09","date_gmt":"2019-07-30T17:10:09","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/07\/30\/news-9688\/"},"modified":"2019-07-30T09:10:09","modified_gmt":"2019-07-30T17:10:09","slug":"news-9688","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/07\/30\/news-9688\/","title":{"rendered":"Exploit kits: summer 2019 review"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 30 Jul 2019 16:20:33 +0000<\/strong><\/p>\n

In the months since our last spring review<\/a>, there has been some interesting activity from several exploit kits. While the playing field remains essentially the same with Internet Explorer and Flash Player as the most-commonly-exploited, it is undeniable that there has been a marked effort from exploit kit authors to add some rather cool tricks to their arsenal.<\/p>\n

For example, several exploit kits are using session-based keys to prevent “offline” replays. This mostly affect security researchers who might want to test the exploit kit in the lab under different scenarios. In other words, a saved network capture won’t be worth much when it comes to attempting to reenact the drive-by in a controlled environment.<\/p>\n

The same is true for better detection of virtual machines and network tools (something known as fingerprinting<\/a>). Combining these evasion techniques with geofencing and VPN detection makes exploit kit hunting more challenging than in previous quarters.<\/p>\n

Threat actors continue to buy traffic from ad networks and use malvertising as their primary delivery method. Leveraging user profiling (their browser type and version, country of origin, etc.) from ad platforms, criminals are able to maintain decent load rates (successful infection per drive-by attempts).<\/p>\n

Summer 2019 overview<\/h3>\n