A Russian website has appeared on the internet selling spyware kits for ten pounds.
The spyware kit, called WebAttacker, is currently available for approximately £10 ($17). The website, which refers to its creators only as spyware and adware developers, touts the strengths of its software and makes the kits available for purchase online - even offering buyers technical support.
Included in the kits are scripts designed to simplify infecting computers. The buyer only needs to send spam to email addresses inviting recipients to visit a compromised website.
Samples found used newsworthy topics to lure unwary users. One presented itself as a warning of the deadly H5N1 bird flu virus and provided links to the bogus website, which purported to contain advice on oneself.
Others claimed that Slobodan Milosevic was murdered and invited users to visit the site for more information. These websites then attempt to download the malicious code remotely onto the user's PC by taking advantage of known web browser and operating system vulnerabilities.
"This type of behaviour is inviting the return of script-kiddies," said Carole Theriault, senior security consultant at Sophos. "By simplifying the task of the potential hacker for a mere tenner, sites like this one will attract opportunists who aren't necessarily very skilled and turn them into cyber-criminals."
JavaScript code on the infected websites detects the visiting computer's browser version and operating system, including any installed patches, and launches the most appropriate exploit. The exploit downloads a program that attempts to turn off the firewall and install malware, generally a password stealer, keylogger or a banking trojan.
"The underground cybereconomy is, in some ways, very similar to the one most of us operate by - everyone wants a piece of the action," continued Theriault. "The more common cyberattacks become, the more we will see these types of sites offering kits, databases of email addresses, as well as bespoke trojans and spyware. So as long as the money continues to flow, there will be interested parties."
