MPack (software)

From Wikipedia, the free encyclopedia

In computer security, MPack is a PHP-based malware kit produced by Russian crackers. The first version was released in December 2006. Since then a new version is thought to have been released roughly every month. It is thought to have been used to infect up to 160,000 PCs with keylogging software. In August 2007 it was believed to have been used in an attack on the web site of the Bank of India which originated from the Russian Business Network.

Unusually for such kits, MPack is sold as commercial software (costing $500 to $1,000 US), and is provided by its developers with technical support and regular updates of the software vulnerabilities it exploits. Modules are sold by the developers containing new exploits. These cost between $50 and $150 US depending on how severe the exploit is. The developers also charge to make the scripts and executables undetectable by antivirus software.

The server-side software in the kit is able to customize attacks to a variety of web browsers including Microsoft Internet Explorer, Mozilla Firefox and Opera. MPack generally works by being loaded in an IFrame attached to the bottom of a hacked website. When a user visits the page, MPack sends a script that loads in the IFrame and determines if any vulnerabilities in the browser or operating system can be exploited. If it finds any, it will exploit them and store various statistics for future reference.

Included with the server is a management console, which allows the attacker deploying the software to view statistics about the computers that have been infected, including what web browsers they were using and what countries their connections originated from.

Experts at Spy-Ops have estimated that the market for hacker toolkits such as MPack has exploded into hundreds of millions of dollars USD annually.

[edit] Other uses in computing

MPack should not be confused with mpack, which is a harmless command-line utility for manipulating MIME-encoded messages.

[edit] References

• Hackers target 'legitimate' sites. BBC (2007-06-20). Retrieved on 2007-06-26.
• MPack, Packed Full of Badness. Symantec (2007-05-27). Retrieved on 2007-06-26.
• PandaLabs Report: MPack uncovered. PandaLabs (2007-05-11). Retrieved on 2007-07-04.
• MPack malware exposes cheapskate web hosts. The Register (2007-07-04). Retrieved on 2007-07-04.
• Interview with MPack developer. The Register (2007-07-23). Retrieved on 2007-07-23.
• Brian Krebs (2007-10-13). Mapping the Russian Business Network. Washington Post blogs. Retrieved on 2007-10-14.
• Gregg Keizer (2007-09-31). Bank of India site hacked, serves up 22 exploits. Computer World. Retrieved on 2007-10-14.

This malware-related article is a stub. You can help Wikipedia by expanding it.