Hackers target third new zero-day for Adobe Flash

Security researchers have advised users of Adobe's Flash Player to disable the software temporarily, as yet another remotely exploitable vulnerability is being actively attacked by would-be hackers.

The bug has the potential to allow attackers to take full control of users' computers without their interaction.

Recently-released Flash Player versions 16.0.0.296 for Microsoft Windows and Apple OS X are vulnerable to the CVE-2015-0313 vulnerability, which Adobe rates as critical. Versions 13.0.0.264 and earlier are also vulnerable, along with Flash Player 11.2.202.440 and earlier for Linux.

Security vendor Trend Micro is credited with discovering the new zero-day vulnerability alongside two Microsoft researchers.

The company said CVE-2015-0313 is being actively exploited in drive-by attacks delivered via malicious advertisements, believed to have been executed through the Angler Exploit Kit.

"Malvertisements" on popular websites redirect visitors to a series of other sites, finally landing at a Russian-registered domain that attempts to deliver the payload that executes the exploit.

Trend Micro said it has already counted over 3000 hits related to CVE-2015-0313, suggesting the vulnerability is being widely used by attackers.

Neither the security vendor nor Adobe have yet published a full analysis of the new zero-day, which is the third to strike the popular Flash Player software in a month.

Bogus Apple invoice leads to Blackhole, banking malware

If you receive an invoice seemingly coming from Apple that apparently shows that your credit card has been billed for $699,99 (or a similar preposterously huge amount of money) because you bought postcard, don't click on any of the embedded links no matter how curious or alarmed you are.

The bogus invoice looks good enough to fool many (click on the screenshot to enlarge it):



"The link 'View/Download' ends in download.jpg.exe, while the 'Cancel' and 'Not your order' URLs end in check.php," shares Graham Cluley. "The smart social engineering bit is that, whether you are simply curious what this is about or furious about this unauthorized charge, you are still likely to click one of the links."

A click on the former link will automatically download the malware, while a click on the latter ones will take the victims to a bogus IRS page warning them that they are using an unsupported browser.

But this is simply a smokescreen designed to puzzle the user while the Blackhole exploit kit works furiously in the background, trying to exploit a host of Oracle Java, Adobe Flash Player and Adobe Reader vulnerabilities.

If it succeeds, the victims' computer is infected with a variant of the Zeus / Zbot banking Trojan. If not, they are offered a download of the latest version of their browser. The offered file is named update.exe and is also a Zeus Trojan variant.

Malware Infested Twitter Messages Contain Fake Facebook Links

Twitter users need to be on the lookout for a new round of malware-carrying spam messages that are coming from compromised accounts, possibly even from Twitter profiles they trust.

If you receive a direct message suggesting that someone has posted or tagged you in a Facebook video, beware. Clicking on the link could infect your computer with malware. According to the Sophos Naked Security blog, the direct messages are not originating from spam accounts, but instead compromised accounts of friends - which makes it even more likely that a careless user could fall victim.

Although the messages vary, the common thread between all of them is that they contain a "facebook.com/________" link and mention that a video of you has been posted on Facebook. "Your in this facebook.com/________ video, LOL" reads one spam message, while another says "you even see him taping u, that's awful."

When an unsuspecting user clicks on the link, they are shown a YouTube video player and prompted with a message that says, "and update for YouTube player is needed. It says that it will install Flash Player 10.1 onto your computer, but instead installs "Troj/Mdrop-EML, a backdoor Trojan that can also copy itself to accessible drives and network shares," according to Sophos.

Of course, clicking on any link in a direct message that links you offsite is risky, and the fact that these messages are coming from trusted sources makes it especially tricky. However, the fact that the messages contain various misspellings and gramatical errors should suggest to the discerning user that they might not be legit.

Trojan posing as Flash Player for Android

Russian Android users are constantly targeted with Trojans posing as legitimate apps. Last month it was fake Instagram and Angry Birds Space apps, this time the lure is a bogus Flash Player for Android:



"When users opt to download and install the said fake app, the site connects to another URL to download a malicious .APK file," Trend Micro researchers warn.

The file in question is a premium service Trojan that saddles users with unwanted charges.

Both the website offering the fake app and the one from which the Trojan is downloaded are hosted on the same IP address - a Russian domain.

"Based on the naming alone used in these URLs, it appears that Android is a favorite target for cybercriminals behind this scheme," conclude the researchers.

SMS-controlled Android malware records calls

Researchers at NQ Mobile Security have discovered a new piece of Android malware that receives instructions, i.e. is controlled, via SMS.

Dubbed TigerBot, the Trojan hides by not showing any icon on the home screen and takes the names and icons of popular and common Google and Adobe apps like "Flash" or "System" in order to blend in with the legitimate apps installed on the phone.

"In order to receive remote commands, it registers a receiver with a high priority to listen to the intent with action 'android.provider.Telephony.SMS_RECEIVED'," point out the researchers. "As a result, it can receive and intercept incoming SMS messages before others with lower priorities."

The capabilities of the malware include: recording phone calls, changing network settings, uploading the current GPS location, capturing and uploading images, sending text messages to a particular number (but, it seems, not a premium service one), rebooting the phone and killing other running processes. Still, not all the actions are always effective.

So far, the Trojan hasn't been detected being offered on Google Play (the former Google’s Android Market), but only on third-party online marketplaces.

The researchers urge users to always be careful when downloading new apps.

"Only download applications from trusted sources, reputable application stores, and markets, and be sure to check reviews, ratings and developer information before downloading," they say.

U.S. military contractors targeted with malicious PDFs

The last few months have seen a lot of cyber attacks aimed at U.S. military contractors and they are still ongoing.

F-Secure researchers have recently spotted an email obviously directed at military contractors' employees, which contains a malicious .pdf attachment.

"When opened in Adobe Reader, it exploits a known Javascript vulnerability and drops a file called lsmm.exe," they explain. "This is a backdoor that connects back to the attacker, who is waiting at IP addresses 59.7.56.50 and 59.19.181.130."

In order to keep the recipient from suspecting foul play, the file then opens a legitimate-looking call for papers for a conference:


It is known that the RSA hack was executed in order to compromise its SecurID tokens, widely used by a great number of companies that do business with the government. But, as this example shows, there are easier ways to gain access to their computers.

PDF-Pro multiple vulnerabilities

Several vulnerabilities in PDF-Pro can be exploited by malicious people to compromise a user's system, according to Secunia.


1. The application loads libraries (e.g. dwmapi.dll) in an insecure manner, which can be exploited to load arbitrary libraries by tricking a user into e.g. opening a PDF file located on a remote WebDAV or SMB share.

2. A boundary error in the bundled PDF Reader ActiveX control (ePapyrusReader.ocx) when handling arguments passed to the "open()" method can be exploited to cause a stack-based buffer overflow.

3. Two boundary errors in ePapyrusReader.ocx when handling arguments passed to the "open_stream()" method can be exploited to cause heap-based buffer overflows.

4. A use-after-free error in ePapyrusReader.ocx when handling arguments passed to the "open_stream()" method can be exploited to dereference already freed memory.

5. A use-after-free error in ePapyrusReader.ocx when encountering corrupted arrays in a dictionary can be exploited to dereference already freed memory via a specially crafted PDF file.

6. The unsafe "RemoveFile()" method provided by ePapyrusReader.ocx allows deleting arbitrary files on a user's system.

7. The unsafe "DownloadFTP()" method in combination with the "SetFTPInfo()" method provided by ePapyrusReader.ocx allows downloading arbitrary files to a user's system.

8. The unsafe "UploadFTP" method in combination with the "SetFTPInfo()" method provided by ePapyrusReader.ocx allows retrieving arbitrary files from a user's system.

The vulnerabilities are confirmed in version 4.0.1.758 bundling ePapyrusReader.ocx version 1.6.2.1874. Other versions may also be affected.

Solution: Set the kill-bit for the affected ActiveX control and do not open untrusted PDF files.

Adobe PDF format riddled with exploitable features

Adobe's PDF format and standard has been known for a while now to be easily exploitable and, thus, rather insecure. In the past, attackers have taken advantage not only of its vulnerabilities, but of its features as well. And as Adobe has recently announced a sandbox for Adobe Reader, some experts wonder if it's enough.

As Julia Wolf, a researcher with security company FireEye, pointed out at the 27th Chaos Communication Congress in Berlin - the current PDF standard is riddled with functions that can be misused in various ways.

According to her, a PDF file can have a database scanner embedded in it which is rigged to start scanning as soon as the file is printed on a network printer. It can also be made to display completely different content depending on the OS, browser, PDF reader software or language settings used on the computer.

What's more, some of its functions can be used to set off arbitrary code execution. The fact that the standard supports many insecure formats (XML), technologies (RFID tags) and script languages (JavaScript) only adds to its weak security.

According to The H Security she also mentioned that, interestingly enough, Adobe calls the the PDF format a "container format". And, indeed, it can contain many things - from audio and video to Flash files, which can, in their turn, be exploited by the attackers.

But, one of the biggest problems regarding the exploitation of this feature is that most anti-malware solutions fail to detect this embedded malicious software, and the detection rate is poorer still if the malicious code is compressed.

All in all, the sandboxing feature will be a welcome addition to the new version of Adobe Reader. Whether it will solve the problems she described, it remains to be seen.

New 0-day flaw in Flash Player exploited in the wild?

Bad news just keep piling on Adobe - it looks like there is a new zero-day vulnerability in their Flash Player that is being exploited in the wild.

Its existence is still to be confirmed by Adobe, but security researcher Mila Parkour from the Contagio Malware Dump blog seems to think it may be the real deal. According to her, the vulnerability is exploited via a malicious .pdf document sent as an attachment, and two files are dropped - and executed - on the system: nsunday.exe and nsunday.dll.

They are both components of a variant of Wisp - an information-stealing and downloader Trojan and, according to Softpedia, it is currently detected by 15 of the 42 AV solution used on VirusTotal.

If the flaw and its use in the wild is confirmed, Adobe will have to scramble to put out a patch way ahead of the selected date for the next security update. In the meantime, users could prevent becoming victims by disabling Flash support in Adobe Reader.

UPDATE: Apple has confirmed the existence of the vulnerability and plans to issue a patch for Flash Player around November 9 and patched up versions of Adobe Reader and Acrobat around November 15.

Bogus Adobe employees sell fake PDF program

A series of e-mails purportedly sent by Adobe Acrobat Reader Support employees in which the users are urged to activate their "new Adobe PDF Reader" have been hitting inboxes worldwide.

According to Softpedia, the embedded link (www.adobe-download-center.com) redirects the users to another URL (www.pdf-new-2010-download.com), where a bogus program by the name of PDF Pro 2010 is offered on sale.

A hint that this might not be a legitimate offer comes from the fact that users are encouraged to download the file with a promise to receive a free copy of "the best ALL-IN-ONE Office Solution for Your PDF Files!". It is safe to say that any company is unlikely to offer free PDF software along its paid one.

Also, it seems that a variant of this e-mail has been sent out for weeks now. An entry on Adobe's forum posted in late September indicates that a similar message - with the subject line Adobe PDF Reader software upgrade notification - links to a site that tries to install various malware on the users' system.

Don't be fooled by these messages, because Adobe would never send you unsolicited e-mails, even if they want you to patch your software. And even if you are subscribed to one Adobe's mailing lists, if always pays to be extra careful and check the offered link by rolling over it first.

The rise of Java exploits

Sifting through the data collected and analyzed in order to compile the latest Microsoft Security Intelligence Report, senior program manager Holly Stewart came to an interesting conclusion: Java exploits have become way more popular with hackers than the Adobe-related ones:


This enormous jump is, according to Stewart, due to the fact that three particular vulnerabilities are being constantly exploited. Brian Krebs offers his own explanation: Java exploits have been incorporated into a number of popular exploit packs (Eleonore, Crimepack, SEO Sploit Pack, Blackhole).

These vulnerabilities have been patched for a while, but the problem is that users fail to update Java on their system. "Java is ubiquitous, and, as was once true with browsers and document readers like Adobe Acrobat, people don't think to update it. On top of that, Java is a technology that runs in the background to make more visible components work. How do you know if you have Java installed or if it's running?" says Stewart.

Given that Oracle has recently issued a Java security update that patches nearly 30 vulnerabilities, this would be a good time for all users to update the program or check for its existence on their systems and then update it. And while they're at it, they could configure the built-in updater to check for new versions every week.

Adobe plugs 23 holes in Reader, Acrobat

As expected, Adobe released updates for Reader and Acrobat today that fix 23 holes in the popular PDF-viewing programs, including two that are actively being exploited in attacks that could allow someone to take control of the computer.

One of the critical vulnerabilities is being used in attacks against Reader and Acrobat; the other, fixed in an emergency update late last month, targets Flash Player.

The updates affect Adobe Reader 9.3.4 for Windows, Macintosh, and Unix; Adobe Acrobat 9.3.4 for Windows and Macintosh; and Adobe Reader 8.2.4 and Acrobat 8.2.4 for Windows and Macintosh to resolve issues in Reader, Acrobat, and Flash Player. Details are in the latest security advisory.

The next quarterly security updates for Adobe Reader and Acrobat are scheduled for February 8, 2011.

Critical 0-day Adobe Acrobat, Reader flaw exploited in the wild

Adobe has released a security advisory warning users about a newly discovered 0-day vulnerability that has already been spotted getting exploited in the wild.

The flaw affects all current versions of Adobe Reader for Windows, Macintosh and UNIX, and of Adobe Acrobat for Windows and Macintosh. "This vulnerability (CVE-2010-2883) could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of public exploit code for this vulnerability," says in the advisory.

The company is still evaluating when a security update to resolve the flaw will be pushed out, and they haven't provided any mitigating instructions so far.

In the meantime, vendors of security solutions have begun detecting malware that exploits the vulnerability. Trend Micro has detected a Trojan that arrives as an attachment to spam email messages, which drops a downloader into the system. This downloader leads to another one, which is downloaded - along with other malware - from various (currently unavailable) URLs.

A quick search for the registration information for those URLs revealed that the registrant is located in Hong Kong, but the servers that host the site are located in the U.S. and in Germany.

Another interesting fact is that the malicious file is digitally signed with a valid certificate of a legitimate American credit union:

Adobe is urging users to keep their anti-malware solutions up-to-date in order to protect themselves until a patch is issued.

Facebook users receiving direct messages from Koobface

Every so often, the Koobface botnet mounts a campaign to increase the number of infected systems, and this latest one employs an already tried tactic.

According to Trend Micro, Facebook users receive a direct message, and the message contains a simple line of text and a link. The text reads: "Someobdy uplaod a vdieo wtih you on utbue. you shuold see", and the link points to a Facebook page whose URL looks like this:

http://www.facebook.com/l/

{random character};{redirected URL}

ANY link poing to such an URL will bring up the Facebook preview page for external links, and if the user ignores the warnings about the potential dangers of following the link to the final destination, he will be faced with a site (hosted on several different IP addresses) apparently displaying the video:

To view the video, the user must download a Flash Player update. As you may already suspect, the offered file is a Koobface variant that proceeds to infect the system and download additional malware.

Malicious PDF spam with Sality virus

Malicious spammers will try every approach they can think of to make you open the attachments included in emails.

Sophos warns that a malicious email containing the following text has been dropped into inboxes around the world:

"Hey man.. Remember all those long distance phone calls we made. Well I got my telephone bill and WOW. Please help me and look at the bill see which calls where yours ok.."

You surely don't remember such an occurrence or the sender of the email, since this is just a ploy to make you open the PhoneCalls.pdf attachment, but don't let your innate curiosity get the better of you.

The attached file is crafted in such a way that it can exploit a vulnerability in how Adobe Reader handles TIFF images, and proceeds to download and execute a Trojan that loads the Sality virus into your system's memory. The virus then proceeds to append its encrypted code to executable files, deploys a rootkit and kills anti-virus applications.

Having an up-to-date version of Acrobat Reader and of an anti-virus solution installed can help detect this threat, but teaching yourself to detect suspicious emails such as this one is also a great idea.

Just remember that opening documents attached to unsolicited emails is like the online equivalent of Russian roulette - the odds are stacked heavily against you.

Critical Adobe Flash, Reader 0-day flaw exploited in the wild

A zero-day flaw affecting 10.0.x and 9.0.x versions of Adobe Flash Player - including the current version, which is 10.0.45.2 - has been spotted being exploited in the wild. The flaw also affects Adobe Reader and Acrobat 9.3.2 and earlier 9.x, since the vulnerable authplay.dll component ships with those products.

Adobe released on Friday the security advisory detailing the particulars of the critical vulnerability, saying that it "could cause a crash and potentially allow an attacker to take control of the affected system," and that "there are reports that this vulnerability is being actively exploited in the wild against both Adobe Flash Player, and Adobe Reader and Acrobat."

While waiting for the fix to be pushed out, Adobe advises users to switch to Flash Player 10.1 Release Candidate, which does not appear to be vulnerable, or "deleting, renaming, or removing access to the authplay.dll file that ships with Adobe Reader and Acrobat 9.x." This action mitigates the threat, but users will be unable to open PDF files with Flash content because the program will crash or they will witness an error message.

Critical vulnerabilities in Photoshop CS4

Critical vulnerabilities have been identified in Photoshop CS4 11.01 and earlier for Windows and Macintosh that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system.

A malicious .ASL, .ABR, or .GRD file must be opened in Photoshop CS4 by the user for an attacker to be able to exploit these vulnerabilities.

Adobe recommends Photoshop CS4 customers update to Photoshop CS4 11.0.2, which resolves these issues. Adobe also encourages all customers to follow security best practices by exercising caution before opening any unknown file or files from unknown sources, regardless of the application used to open the file.

These issues do not affect Photoshop CS5.

To verify the version of Adobe Photoshop CS4 currently installed, choose Help > About Adobe Photoshop CS4 from the Adobe Photoshop menu bar. To check for updates, choose Help > Updates from the Adobe Photoshop menu bar.

Photoshop CS4 customers can find the Photoshop CS4 11.0.2 update for Windows or Macintosh here:

• Adobe Photoshop CS4 11.0.2 update for Windows
• Adobe Photoshop CS4 11.0.2 update for Macintosh.

Skeletons in Adobe's security closet

How many of you out there, perform a computer restart when you are prompted to do so after a software installation or update (unless forced to)? Well, if you're guilty of not doing so, you may seriously want to consider doing so from now onwards.

Some findings revealed:

"While it is true that the Adobe Download Manager is removed upon computer restart, the user, who has just updated their Adobe product (usually without the requirement to restart the computer after the update), is still exposed to forced automatic installation until they restart their computer."

"On the same day I published my last blog post, I found yet another issue — a remote code execution flaw in the Adobe Download Manager. Basically, what I found is that an attacker can force an automatic download and installation of ANY executable he desires. So, if you go to Adobe’s website to install a security update for Flash, you really expose yourself to a zero-day attack."

Full report here.

Security updates for Adobe Reader and Acrobat

A critical vulnerability has been identified in Adobe Reader 9.3 for Windows, Macintosh and UNIX, Adobe Acrobat 9.3 for Windows and Macintosh, and Adobe Reader 8.2 and Acrobat 8.2 for Windows and Macintosh.

This vulnerability (CVE-2010-0186) could subvert the domain sandbox and make unauthorized cross-domain requests. In addition, a critical vulnerability (CVE-2010-0188) has been identified that could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Users can utilize the product's automatic update facility. The default installation configuration runs automatic updates on a regular schedule, and can be manually activated by choosing Help > Check For Updates Now.

Adobe pushes out Flash security fix

Adobe has published a cross-platform update for Flash that addresses a potentially serious security flaw.

Flash Player users are advised to upgrade to version 10.0.45.2 to plug a hole in earlier versions of the software that means the domain sandbox security protection could be bypassed to make unauthorized cross-domain requests.

The two-part fix means surfers also need to upgrade to Adobe AIR version 1.5.3.1930, as explained in Adobe's bulletin here.

The cross-platform update applies to Windows, Mac and Linux versions of the software.

In related news, Adobe promised relief from a critical vulnerability in Acrobat and Reader with a patch due to arrive next Tuesday, 16 February. This fix is related to the Flash problem which is why Adobe is releasing an update outside its recently announced quarterly patch cycle.

Flaws in Adobe software, second only to Microsoft, have been exploited in numerous targeted hacker attack over recent months, prompting some security watchers to advise users to consider the use of alternative PDF readers. Adobe is beginning to get to grips with the problem but its patching process often remains cumbersome and fiddly.