Flash Zero Day Being Exploited In The Wild

Outsmart Malicious Hackers

This is not the first Flash Zero Day and it certainly won’t be the last, thanks to the Sandbox implemented in Chrome since 2011 – users of the browser are fairly safe.

Those using IE are in danger (as usual) and certain versions of Firefox.

Flash Zero Day Being Exploited In The Wild

It has been rolled into the popular Angler Exploit Kit, which seems fairly prevalent although not as popular as Blackhole historically.

A zero day Flash vulnerability is being actively exploited by criminals using the popular Angler exploit kit. Adobe is investigating the report by respected French malware researcher Kafeine, who found the exploit kit circulating on cybercrime forums.

The vulnerabilities affected Flash Player versions up to and the latest, he said. Punters on Windows 8.1 are safe, along with those using Google Chrome thanks to use of sandboxing.

Those operating other Windows platforms with Internet Explorer versions 10 and below, and some Mozilla Firefox versions, have been confirmed as vulnerable to the exploit. The free version of MalwareBytes’ Anti-Exploit tool prevented the attack, but it is as yet unknown if Microsoft’s Enhanced Mitigation Exploit Tool can fight the attack.

It’s not yet known if Microsoft EMET blocks this attack, but MBAE does.

It seems like the drive by malware slingers are stepping up their game and investing time into obfuscation and encrypted payloads to make detection/blocking more difficult.

The exploit kit drops the Bedep trojan which could serve as a persistent advertising slinger and malware downloader, (last version of Win7 at least) is bypassed. Angler remains one of the most proflic exploit kits.

The zero-day came as Cisco warned separately that exploit kit writers were taking more time to write obfuscated code. This would ostensibly prolong the life of investments such as the discovered Flash zero day that would decrease in effectiveness after users applied the imminent Adobe patches. Cisco bods in a new annual report (pdf) painted Angler as the most active kit last year, followed by Sweet Orange and Goon.

“Angler’s use of Flash, Java, Microsoft Internet Explorer, and even Silverlight vulnerabilities makes this exploit kit the ‘one to watch’,” Cisco bods said.

“Once the exploit is triggered, the malware payload is written directly into memory in a process such as iexplore.exe, instead of being written to a disk. “The payload delivered by Angler looks like a blob of encrypted data, which makes it harder to identify and block.” Angler was more popular having spiked in August thanks to a developer decision to nix the need to download Windows executables to foist malware.

It seems like there’s quite a few Exploit kits floating around, which basically bundle together a whole set of exploits and pop a web browser however they can to install further malware, things like Bedep just slurp down even more malware and install that covertly on a victims machine.

That’s usually why when you see an infected machine, it has a LOT of malware on it – not just one thing.

Source: The Register

Posted in: Exploits/Vulnerabilities, Malware

, , , ,

Latest Posts:

GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.
QualysGuard - Vulnerability Management Tool QualysGuard – Vulnerability Management Tool
QualysGuard is a web-based vulnerability management tool provided by Qualys, Inc, which was the first company to deliver vulnerability management services as a SaaS-based web-service.
Memcached DDoS Attacks Will Be BIG In 2018 Memcached DDoS Attacks Will Be BIG In 2018
So after the massive DDoS attack trend in 2016 it seems like 2018 is going to the year of the Memcached DDoS amplification attack with so many insecure Memcached servers available on the public Internet.
libsodium - Easy-to-use Software Library For Encryption libsodium – Easy-to-use Software Library For Encryption
Sodium is a new, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable, packageable fork of NaCl, with a compatible API.
XSStrike - Advanced XSS Fuzzer & Exploitation Suite XSStrike – Advanced XSS Fuzzer & Exploitation Suite
XSStrike is an advanced XSS detection suite, which contains a powerful XSS fuzzer and provides zero false positive results using fuzzy matching. XSStrike is the first XSS scanner to generate its own payloads.

Comments are closed.