In their February Online Fraud Report RSA shed light on one of the latest Fraud-as-a-Service (FaaS) offerings to be purveyed in the criminal underground, a new release of the “Darkness”, aka “Optima,” DDoS bot crimeware; a commercially available toolkit that not only allows fraudsters to launch DDoS attacks at a target of their choice, but which has also been enhanced with several Trojan-like functionalities.

The ‘Darkness’ DDoS bot is used to perpetrate DDoS attacks by flooding targeted websites with junk traffic originating from unwitting users’ systems. The first version of Darkness saw light in March 2009, and according to the Russian-based fraudster who posted the ad and claims to manage the Darkness “project,” the latest release contains several improvements such as enhanced flooding capabilities, an improved password grabber module, and a new module that installs SOCKS5 on victims’ systems. The vendor behind the ad claims to have been “verified” within Russian-speaking forums, and offers interested parties links to reviews of his product.

Darkness was originally coded to be the DDoS weapon of choice, but since then, several new modules have been authored for the bot, bestowing it with Trojan-like functionalities. And much like Trojan authors, Darkness’ coders have established a few security mechanisms to hinder their product’s operations from being shut down. Demonstrating the invisible hand of the market forces that govern the underground supply chain, this latest criminal offering is being rolled out in the fraudster community following a year that has been replete with numerous hacktivist DDoS attacks.

The business of selling the Darkness bot

The Darkness bot is sold as a compiled binary, for which the customer can define three Command & Control (C&C) server domains  in order to ensure operational continuity in the event of a server takedown (by LE, ISPs, CERTs, etc.).

Darkness is sold as a FaaS offering with a customer receiving a complete, fully operational administration panel on the C&C domains of his choice.

While a “Minimum” package containing the DDoS bot binary is sold for $330, a “Brilliant” package offered for $850 includes unlimited free updates, a full set of modules and unlimited ‘free’ recompiles (“rebuilds”). Further demonstrating the FaaS business model, additional services and bot features are sold separately:

  • The Darkness bot’s source code (version 10) – $3,500-$5,000
  • Individual rebuilds – $35
  • Bot updates – $85
  • Socks5 module – $250
  • Key logger module – $55
  • Password grabber – $50
  • Hosts file editor – $35

After paying for the bot’s setup, all a fraudster would have to do is infect victims’ systems using an exploit kit of his choosing. As soon as a system is infected, it appears on the customer’s web panel, with such details as country, IP address, OS, and user privileges (admin vs. user account). According to the ad, “Excellent bilingual support (Ru, Eng)” is provided.

Interestingly, to avoid liability issues, the writer of the ad disclaims any use of the Darkness bot for purposes other than IT testing.

DDoS functionality

The Darkness bot offers four types of DDoS attacks:

  1. HTTP: An attack method whereby bots flood a targeted website’s resources by sending it an overwhelming number of standard HTTP (HyperText Transfer Protocol) requests.
  2. ICMP: An attack whereby bots send data packets over the ICMP protocol (Internet Control Message Protocol), and flood all the systems operating behind a network by targeting a range of IP addresses  instead of a single IP or domain. This method exploits network devices that have not been properly configured to thwart this kind of attack.
  3. SYN: An attack that initiates a great number of TCP connections, which can only be established when a three-way handshake between two systems (a client and server) has been completed. SYN attacks drain a targeted site’s resources by initiating numerous TCP connections, but never properly completing the three-way handshake. This results in the targeted site (server) needlessly ‘waiting’ for an acknowledgement (by the client) of the new TCP connection and its being rendered unavailable for legitimate traffic.
  4. UDP: Attacks deploying  the UDP protocol (User Datagram Protocol) rely on the fact that for every erroneous  UDP packet  sent to a given resource, an ICMP Destination Unreachable packet needs to be returned, serving as an “Error, Return to Sender” message. Flooding the targeted site with incoming UDP packets  results in a counter- flood of outgoing  ICMP Destination Unreachable packets, which ultimately render the site unavailable to legitimate users.

According to a Darkness ad reported in 2010, an average website can be brought down using only 30 infected systems (bots), while 1,000 would be required for large website. The writer of the Darkness ad further claims that a high-profile website like (Russian social network), which in November 2010 reported 100 million users, would require 15,000-20,000 bots.

Trojan-like modules

Modules added to the latest release of the Darkness bot (version 10), enhance the code with functionalities typical of Trojan codes, and are sold separately much like commercial Trojan add-ons:

  • Mini-Loader Function: The ad mentions that the bot has a “Mini-Loader function: it’s possible to load your  EXE files to the bots.” Thanks to this functionality, fraudsters looking to download a financial Trojan to an already-infected system can easily do so.
  • SOCKS5 Backconnect Module: SOCKS5 modules are often installed on victims’ systems by financial Trojans, enabling fraudsters to exploit users’ systems as proxies; a feature that allows fraudsters to ‘backconnect’ from a Command & Control server to a targeted website via the victim’s system. This module enables fraudsters to access a site while appearing to operate from the victim’s IP address.
  • Password Grabber Module: The password grabber offered by the bot’s vendor can grab passwords from 14 different applications, including various FTP sites, instant- messaging programs, and webmail programs, as well various online forms.
  • Hosts File Editor Module: This functionality enables botmasters to reroute victims to malicious websites by editing their hosts file, which is a local file that serves as the first point of reference when a user’s system searches for an internet resource, such as a domain or IP address. Brazilian Banker Trojans often edit victims’ hosts files to reroute them to phishing pages that mimic targeted banks’ websites.
  • Key logger Module: This module enables Darkness operators to log all the keystrokes entered online by their victims – a feature that is rarely used by today’s advanced Trojans, given their ability to intercept all HTTP and HTTPs communications (for example, the Zeus Trojan and its derivatives no longer keylog at all.)

Security countermeasures

Darkness’ coders have invested some effort in attempting to conceal their product’s operation. As mentioned above, each Darkness binary can be configured with up to three different C&C server domains, enabling backup of the bot’s resources in the event of a domain’s suspension or a server takedown. In addition, they claim that the bot can bypass Windows’ firewall, and that it employs “some trick to bypass DDoS Protections.” While the ad claims that Darkness’ processes and resources remain invisible to the user, a previous version of the bot has reportedly failed to disguise its processes.

DDoS attacks and hacktivism

This latest criminal offering is being rolled out in the fraudster community following a year that has been replete with numerous hacktivist DDoS attacks initiated by various groups such as Anonymous, TeamPoison, AntiSec, LulzSec, and others. In 2011, high-profile victims of DDoS attacks waged by hacktivist groups included: Sony’s Playstation Network, the CIA’s website, the FBI, UK tabloid The Sun, the Spanish Police, and the government websites of Egypt, Tunisia and Turkey.

The latest set of DDoS attacks was launched last month by Anonymous (January 19, 2012), its victims comprising proponents of the controversial SOPA and PIPA bills, including the Recording Industry Association of America (RIAA), Motion Picture Association of America (MPAA), Broadcast Music, Inc. (BMI), and the FBI.

The weapon of choice for some of these attacks was Low Orbit Ion Cannon (LOIC), a free open-source program that can also serve legitimate purposes, such as testing the durability of an Internet resource in the event of a DDoS attack.  To launch an orchestrated attack that leverages their power as a community, fraudsters installed the program on their system, willingly forming a large botnet that was controlled by a central Command & Control server. At a predefined time, the C&C server issued a command to the fraudsters’ systems to start flooding victim sites with junk traffic, resulting in their temporary ‘denial of service.’

Aligning itself with the invisible hand of demand, the “Darkness” bot satisfies fraudsters’ increasing motivation to unite against perceived foes, while also fulfilling a role of a user- friendly malware kit.

And “Darkness” is not the only Trojan kit from which fraudsters can launch DDoS attacks. In March 2011, the FraudAction Research Lab reported  on a DDoS plugin traced in a variant of the SpyEye Trojan. The DDoS plugin, however, is not sold as part of the SpyEye Trojan kit, but rather it was privately developed by an individual botmaster. Recent versions of the SpyEye builder are sold with a Software Development Kit (SDK) to facilitate the development of new modules by individual botmasters.

In light of a growing interest in the underground to launch DDoS attacks against financial institutions, data security companies, law enforcement agencies, and various government bodies, we are likely to see a growing number of DDoS-enabling modules and malware kits offered in the underground market in the near future.

Phishing Attacks per Month

The year 2012 has started off with a 42% increase in the number of phishing attacks launched, with 29,974 unique attacks identified by RSA in January. Last month also saw an increase in the total number of brands attacked and the number of attacks endured by individual brands.

Number of Brands Attacked

A total of 281 brands were targeted by phishing attacks in January, marking a 10% increase from the number of targets recorded in December 2011.

US Bank Types Attacked

Nationwide U.S. brands accounted for 68% of the brands targeted in the U.S. financial sector, marking a 14% decrease from December 2011. Also in January, the portion of targeted U.S. credit union brands increased 13% and U.S. regional bank brands increased 4%.

Top Countries by Attack Volume

The UK has remained the country targeted by the highest volume of phishing attacks for the fifth consecutive month with a 10% increase since last month. In total, the UK was targeted by 60% of the world’s phishing attacks in January. While the U.S. saw a 5% decrease in the volume of attacks, the volume targeting Canada increased by 2%. The countries that have consistently suffered the largest volume of phishing attacks over the past year have been the UK, U.S., Canada, and the Netherlands.

Top Countries by Attacked Brands

Combined, U.S. and UK brands accounted for 44% of January’s phishing attacks. Twenty-one (21) other countries absorbed a combined portion of 56% of the world’s attacks, with each country accounting for one to 4% of the world’s targeted brands.

Top Hosting Countries

In January, U.S.-based hosting entities exceeded their normal share of phishing attacks, hosting 82% of worldwide phishing attacks as compared to 50 – 70% of attacks in a typical month.

Previous RSA Online Fraud Report Summaries:

  • The RSA January Online Fraud Report Summary is here.
  • The RSA December Online Fraud Report Summary is here.
  • The RSA November Online Fraud Report Summary is here.
  • The RSA October Online Fraud Report Summary is here.
  • The RSA September Online Fraud Report Summary is here.