An exploit kit is a packaged set of ready made attacks aimed at visitors whose devices still run software with a known weakness.
The criminal points the package at people who open an ordinary page, and the package tries weaknesses until one fits the visitor's browser or plugin.
How it works
A compromised blog, still trusted by its regular readers, sends those readers through the kit without a visible download they chose.
A visitor with an old browser may then find a new program running, while a visitor who is fully updated simply sees the blog.
The harm shows up later as a locked desk at home or as a bank login used from a computer the customer did not intend to share.
The blog owner may be unaware that the page is the delivery path.
Concrete examples
- Readers of a neighborhood blog start seeing strange toolbars after the blog was quietly altered.
- A small charity site sends visitors onward, and several of them report new programs they do not remember installing.
- A support forum with an old page builder becomes the place where unpatched home computers are hit during a weekend.
Protective measures
- Patch browsers and plugins on the computers your household and your office actually use, and remove plugins you no longer need.
- Check your own site for unexpected changes, because a trusted blog is more useful to the kit than an obviously fake page.
- Limit who can edit the public site, and alert when a page changes that nobody on the staff scheduled.
- If a visitor computer starts running unknown programs after a normal browsing session, disconnect it from the office files and rebuild it from a clean source.
Related articles
Readers who want more on visitors of a compromised blog should open What is an advanced persistent threat? next.
For day to day work on visitors of a compromised blog, add What is advanced threat protection? to the same reading list.
People who look after visitors of a compromised blog compare this explanation with What is a computer virus?.