Exploit Kit.

What is an exploit kit?

An exploit kit is a collection of tools that tries to find a weakness in a visitor’s browser or plugins and then delivers exploit code to use it. MITRE ATT&CK covers this under drive-by compromise, which it describes as adversaries gaining access to a system through a user visiting a website over the normal course of browsing. MITRE also notes that a threat group, Dragonfly, has used a custom exploit kit.

How does an exploit kit work?

MITRE describes the usual steps of a drive-by compromise:

• A user visits a website that hosts content controlled by the adversary.
• Scripts run automatically and typically check the versions of the browser and plugins for a potentially vulnerable one.
• If a vulnerable version is found, exploit code is delivered to the browser.
• If the exploit succeeds, the adversary gains code execution on the user’s system, unless other protections are in place.

MITRE says the user may sometimes need to help, for example by enabling scripting or ignoring warning dialogs, and that a second visit is sometimes required before exploit delivery happens.

Where does the malicious content come from?

MITRE lists several delivery routes for drive-by compromise, including compromised legitimate websites, modified script files from cloud storage, malicious ads served through ad providers, and web application vulnerabilities. It gives one example of use by a named group: Dragonfly has compromised targets through strategic web compromise using a custom exploit kit.

Why does it matter?

The compromise starts when a user visits a site during normal browsing. Success depends on whether the browser or plugin is a vulnerable version, so out-of-date software is the weak point. The result of a successful exploit, code execution, can give an attacker a base for further steps.

How can you reduce the risk?

MITRE lists these mitigations for drive-by compromise.

• Keep all browsers and plugins updated, which can help prevent the exploit phase.
• Use ad blockers and script-blocking extensions, which can help stop malicious code from running.
• Use browser sandboxes to limit the impact, although MITRE notes sandbox escapes may still exist.
• Use exploit protection tools that counter exploitation behavior.
• Disable browser push notifications from untrusted sources and train users about social engineering.

Is an exploit kit the same as an exploit?

No. An exploit is code that takes advantage of one bug or vulnerability. An exploit kit is a package that looks for a suitable weakness in a visitor’s system and delivers an exploit for it.

Is an exploit kit the same as malware?

Not exactly. The kit’s job is to get code running on a system. What runs after that is a separate matter. Related terms include proof-of-concept exploit, zero-day vulnerability and malvertising.

Related pages in the Knowledge Hub

• Drive-by Compromise