Menu
Drive-by attack relies on hacked GoDaddy accounts

Drive-by attack relies on hacked GoDaddy accounts

The Angler exploit kit is using subdomains created by cybercriminals on real domain name accounts as part of its infrastructure

Hundreds of hacked domain name accounts registered through GoDaddy are being used as part of a highly effective campaign using the Angler exploit kit to infect computers with malware.

The attackers are using the accounts to create subdomains that shuttle Web surfers to websites hosting Angler, wrote Nick Biasini, an outreach engineer with Cisco Systems.

The owners of the accounts are usually unaware of the activity, which Cisco calls "domain shadowing," since they may rarely log into their accounts. Hundreds of GoDaddy accounts that have several thousand domain names assigned to them have been compromised, Biasini wrote.

At least 10,000 unique subdomains that have been created on those accounts have been used for Angler-related attacks. GoDaddy officials couldn't immediately be reached for comment.

Nearly a third of the domain names on the Internet are registered through GoDaddy, which may be why so many of the compromised accounts are with that registrar, Biasini wrote. The domain name accounts are likely compromised by stealing the login credentials through phishing attacks.

An Angler attack starts when someone views a malicious advertisement. That advertisement then redirects the person to one of the hacked subdomains, which either delivers the exploit kit or redirects to another website hosting the kit.

Cybercriminals have moved to domain shadowing to keep their malware campaigns alive for longer, Biasini wrote. In the past, cybercriminals have registered new domain names that were used for attacks, but those were often quickly blocked.

Domain shadowing is harder to stop. Biasini wrote that the hacked domain name accounts are largely random, so it's hard to predict which ones might be used next in attacks. Blocking is difficult since the cybercriminals can frequently switch to newly generated subdomains, he wrote.

"Some of the subdomains are only active for a matter of minutes and only are reached a couple of times," Biasini wrote.

That has also made it harder for researchers to get a sample of Angler to see what software vulnerabilities it is exploiting.

Angler has proved to be a very effective exploit kit, as its developers quickly incorporate the latest zero-day vulnerabilities in Adobe Systems' software such as Flash and Microsoft's Silverlight multimedia program.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwareCisco SystemsGoDaddy

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments